# auth.md - UpSys Consulting Agent Registration

## Overview
This document specifies authentication and registration procedures for autonomous AI agents connecting to UpSys Consulting services.

## Identification
- **Service**: UpSys Consulting
- **Domain**: https://www.upsys-consulting.com
- **Authorization Server**: https://www.upsys-consulting.com/.well-known/oauth-authorization-server
- **Protected Resource**: https://www.upsys-consulting.com/.well-known/oauth-protected-resource

## Supported Identity Types
UpSys Consulting supports two identity assertion methods for autonomous agents:
1. **Verified Email (`verified_email`)**:
   - Verification via OAuth authorization code flow.
   - UserInfo endpoint: `https://www.upsys-consulting.com/api/auth/oauth2/userinfo`
2. **Identity Assertion (`identity_assertion`)**:
   - Cryptographic identity assertions via RFC 9421 HTTP Message Signatures and ID-JAG token specification (`urn:ietf:params:oauth:token-type:id-jag`).

## Registration
- **Registration Endpoint**: `https://www.upsys-consulting.com/api/auth/oauth2/register`
- **Method**: POST
- **Payload**: JSON with `client_name`, `redirect_uris`, `grant_types`, and `contacts`.

## Token Exchange & Credentials
- **Token Endpoint**: `https://www.upsys-consulting.com/api/auth/oauth2/token`
- **Bearer Method**: `Authorization: Bearer <token>` HTTP header on all API requests.
- **JWKS Endpoint**: `https://www.upsys-consulting.com/api/auth/oauth2/jwks`