# auth.md

## Audience

This document is for automated agents discovering authentication on the merchant storefront **بوتیک امیر** at **https://boutiqueamir.com**.

## Supported authentication (human customers)

- Customers sign in via https://boutiqueamir.com/login (one-time code → session/JWT for storefront actions such as orders)
- Merchant staff manage the shop from the OCEA panel on `*.ocea.app`, not via agent registration on this domain
- OAuth discovery metadata may be present for scanners; **authorize/token return HTTP 501**

## Agent registration

**Not supported** on this storefront. There is no `/agent/auth` provisioning and no live OAuth grants for agents.

## What agents may use

Public, unauthenticated discovery:

- https://boutiqueamir.com/llms.txt
- https://boutiqueamir.com/.well-known/api-catalog
- https://boutiqueamir.com/.well-known/openid-configuration
- https://boutiqueamir.com/.well-known/oauth-protected-resource
- https://boutiqueamir.com/.well-known/agent-card.json
- https://boutiqueamir.com/.well-known/agent-skills/index.json
- https://boutiqueamir.com/.well-known/mcp/server-card.json
- https://boutiqueamir.com/.well-known/acp.json
- https://boutiqueamir.com/.well-known/ucp
- https://boutiqueamir.com/openapi.json
- https://boutiqueamir.com/robots.txt
- https://boutiqueamir.com/sitemap.xml
- Product and category HTML pages
- Homepage / landing with `Accept: text/markdown` (content negotiation)

## Commerce protocols (discovery-only)

- ACP, UCP, and `/openapi.json` are published for scanners. `/acp/*` checkout operations return HTTP 501.
- AP2 is declared on the agent card without live mandates.

## Credential use

Do not automate customer login or harvest OTPs/JWTs. Checkout and account APIs require a human customer session.