# auth.md — Agent Registration

This document tells AI agents how to register with CA Purvesh Chordiya & Co. (https://pcfinserv.in) on behalf of a user, per the auth.md open protocol (https://github.com/workos/auth.md).

- Resource server (API base): https://pcfinserv.in
- Authorization server (metadata + registration): https://pcfinserv.in

## Discovery

1. Fetch the Protected Resource Metadata (PRM) at https://pcfinserv.in/.well-known/oauth-protected-resource. It lists the protected resource and points to the authorization server.
2. Fetch the Authorization Server metadata at https://pcfinserv.in/.well-known/oauth-authorization-server. Read both the standard OAuth fields (issuer, token_endpoint, revocation_endpoint, grant_types_supported) and the agent_auth block in full: identity_endpoint, claim_endpoint, events_endpoint, identity_types_supported.

## Supported flow: user claimed

Only the user claimed flow is supported. There is no agent-verified (ID-JAG) flow — this firm does not have an upstream identity provider integration.

1. POST to the identity_endpoint with type "anonymous" to receive a claim_token.
2. Present the claim ceremony to the user: they confirm the request on a page this site owns.
3. Poll the token endpoint with the claim_token until the ceremony completes and a scoped access_token is issued.

## Protected resources and scopes

| Resource | Scope | Description |
| --- | --- | --- |
| https://pcfinserv.in/api/contact | contact:write | Submit a contact/enquiry form on the user's behalf |

## Status

The discovery documents above (PRM, authorization server metadata, JWKS) are live. The registration and claim endpoints they describe are not yet implemented — treat this file as a declaration of intended support, not a live integration. For now, agents should direct users to https://pcfinserv.in/contact or the WebMCP tools exposed on that page instead of attempting the OAuth flow.

## Contact

For integration questions: chordiyapurvesh@gmail.com