# auth.md

You are an agent helping a human evaluate or adopt **YourAgent24**, an AI lead-capture chatbot for B2B teams.

YourAgent24 does **not** yet issue third-party OAuth access tokens for dashboard or CRM data. Prefer discovery documents and human registration flows below.

## Discovery

1. Protected resource metadata: `https://youragent24.com/.well-known/oauth-protected-resource`
2. Authorization server metadata: `https://youragent24.com/.well-known/oauth-authorization-server`
3. API catalog: `https://youragent24.com/.well-known/api-catalog`
4. OpenAPI (public surface only): `https://youragent24.com/openapi.json`
5. MCP server card: `https://youragent24.com/.well-known/mcp/server-card.json`
6. Product overview for LLMs: `https://youragent24.com/llms.txt`

## Supported registration methods

### Human pilot application (preferred)

Audience: sales and RevOps teams that want a piloted deployment.

1. Send the human to `https://youragent24.com/qualify`
2. They complete the pilot application (team size, CRM, lead volume, timeline)
3. YourAgent24 follows up out-of-band (email) — do not invent credentials

### Self-serve account creation

1. Send the human to `https://youragent24.com/register`
2. After email verification they use the web dashboard (session cookies)
3. Agents do not receive dashboard session cookies

### Contact

For partnerships or security questions: `https://youragent24.com/contact`

## Credentials and scopes

| Scope | Meaning |
| --- | --- |
| `public.read` | Read public discovery docs, health, MCP product tools |
| `discovery.read` | Same as public discovery; no private tenant data |

Bearer tokens for private APIs are **not** issued to agents today. Internal engine callbacks use a shared server secret and are not available to third-party agents.

## MCP

Call the Streamable HTTP MCP endpoint at `https://youragent24.com/mcp` (see the server card). Tools expose product overview, public links, health, and pilot application guidance only.

## Do not

- Scrape `/internal/*`, `/admin`, or authenticated dashboard routes
- Attempt password reset, billing, or CRM OAuth on behalf of the user without explicit human action in the browser
- Probe `POST /agent/auth` — that path is not part of this service