# QuitNicPouches auth.md

## Agent audience

This document is for AI agents, agent registries, and other automated clients that access the public QuitNicPouches website and its read-only discovery resources.

## Authentication status

The resource server is `https://quitzynapp.com`. It does not currently expose a protected API, issue agent credentials, or require an account for its public resources.

Supported authentication method:

- `none` for anonymous `GET` and `HEAD` requests to the public website and discovery endpoints.

OAuth Protected Resource Metadata is not published because this origin has no protected OAuth resource. Agents must not infer an issuer, authorization server, scope, or bearer-token requirement from this document.

## Registration and provisioning

There is currently no agent registration or provisioning endpoint. The registration URI is **none / not applicable**: no client ID, client secret, access-token endpoint, API key, or other agent credential is issued by this service.

Do not probe `POST /agent/auth`, create an account, or submit credentials to this site. The QuitNicPouches app is local-first and does not require a separate QuitNicPouches account for its normal experience.

## Credential use

Send requests without an `Authorization` header or bearer token. Treat the available endpoints as read-only public resources and follow the usage limits and content scope described by each resource. If a client requires authentication, it cannot use a credential issued by this service because no such credential exists.

Useful public resources:

- API catalog: https://quitzynapp.com/.well-known/api-catalog
- OpenAPI description: https://quitzynapp.com/openapi.json
- MCP server card: https://quitzynapp.com/.well-known/mcp/server-card.json
- Web Bot Auth key directory: https://quitzynapp.com/.well-known/http-message-signatures-directory
- ACP discovery document: https://quitzynapp.com/.well-known/acp.json
- Site summary: https://quitzynapp.com/llms.txt

## Web Bot Auth

Automated requests sent by the QuitNicPouches Worker can use Web Bot Auth HTTP Message Signatures. The public Ed25519 verification key is published at the Web Bot Auth key directory above. This identity mechanism authenticates the sending worker; it does not grant access to protected QuitNicPouches resources or replace OAuth.

## Future OAuth support

If QuitNicPouches introduces a protected API, this document will be updated together with OAuth 2.0 or OpenID Connect discovery metadata. The service will then publish a real issuer, authorization endpoint, token endpoint, JWKS URI, supported scopes, and registration or provisioning instructions. Agents should not infer those values from this document today.

For support questions, contact support@quitzynapp.com.