# auth.md

Agent registration and API access for **Vintentra** (`https://vintentra.com`).

## Audience

AI agents and integrators that need to discover or call Vintentra public HTTP APIs.

## How to register

1. Prefer the machine endpoint: `POST https://vintentra.com/api/public/access-request` with JSON `{ "name", "contact", "business?", "region?", "plan?" }`.
2. Or open https://vintentra.com/ and use **Request access**.
3. Or email `hello@vintentra.com` with your agent name, callback URL, and intended scopes.

Credentials are provisioned manually after review (API key / dashboard access). There is no self-serve OAuth token minting for anonymous agents today.

## Supported methods

| Method | Credential | How to claim |
|--------|------------|--------------|
| Anonymous registration | `api_key` (issued offline) | `POST /api/public/access-request` or email |
| Human operator | dashboard session cookie | https://vintentra.com/login |

## Using credentials

- Public marketing endpoints under `/api/public/*` are origin-gated for browsers; agents should register first.
- Bridge / ingest integrations use `X-API-Key` after provisioning.
- See OpenAPI: https://vintentra.com/api/public/openapi.json
- Protected resource metadata: https://vintentra.com/.well-known/oauth-protected-resource
- Authorization server metadata: https://vintentra.com/.well-known/oauth-authorization-server

## Scopes (logical)

- `public:read` — landing stats and discovery documents
- `public:access-request` — submit access requests
- `ingest:bridge` — browser bridge ingest (provisioned)

## Links

- API catalog: https://vintentra.com/.well-known/api-catalog
- Skills: https://vintentra.com/.well-known/agent-skills/index.json
- MCP card: https://vintentra.com/.well-known/mcp/server-card.json