# auth.md — Hope Reformed Baptist Church

You are an agent integrating with **https://hoperb.church**. Most public content (pages, sitemap, calendar ICS export, discovery documents) requires **no access token**. Protected CMS and webhook routes are not exposed for agent registration.

## Step 1 — Discover

Fetch Protected Resource Metadata:

```http
GET /.well-known/oauth-protected-resource
```

Then fetch Authorization Server metadata from the first `authorization_servers` entry:

```http
GET /.well-known/oauth-authorization-server
```

Read the `agent_auth` block for supported identity types and endpoints.

## Step 2 — Pick a method

- **Public read-only APIs** (calendar ICS, health, discovery JSON): call them directly; no registration.
- **Anonymous agent registration** (optional): supported for future scoped tokens. Public site content does not require completing registration.

## Step 3 — Register (optional)

Use `agent_auth.register_uri` from Authorization Server metadata (same URL as `identity_endpoint`):

```http
POST /agent/identity
Content-Type: application/json

{"type":"anonymous"}
```

The service responds with instructions when anonymous registration is not required for your use case.

## Step 4 — Call public APIs

- OpenAPI: `https://hoperb.church/openapi.json`
- API catalogue (linkset): `https://hoperb.church/.well-known/api-catalog`
- Human docs: `https://hoperb.church/docs/api`

## Content signals

See `https://hoperb.church/robots.txt` (`Content-Signal: ai-train=no, search=yes, ai-input=no`).