# auth.md

You are an agent. This document is **auth.md** for https://mirrorsecurity.io.

Mirror Security's public website APIs (blog listing, discovery documents, OpenAPI) do **not** require OAuth access tokens. Use them anonymously. Operator portals (`/site-admin`, `/blog-studio`) use human session cookies and are not agent-registration targets.

## Step 1 — Discover

### 1a. Protected Resource Metadata

```http
GET https://mirrorsecurity.io/.well-known/oauth-protected-resource
```

- `resource` — `https://mirrorsecurity.io/`
- `authorization_servers` — `https://mirrorsecurity.io`
- `scopes_supported` — `public.read` (documentation only; public GETs need no bearer token)
- `bearer_methods_supported` — `header`

### 1b. Authorization Server metadata

```http
GET https://mirrorsecurity.io/.well-known/oauth-authorization-server
GET https://mirrorsecurity.io/.well-known/openid-configuration
```

`issuer` is `https://mirrorsecurity.io` and matches the PRM authorization server.

The `agent_auth` block:

- `skill` — this file
- `register_uri` — https://mirrorsecurity.io/company/contact
- `identity_types_supported` — `anonymous`
- `anonymous.claim_uri` — https://mirrorsecurity.io/company/contact
- `anonymous.credential_types_supported` — `none`

## Step 2 — Register

There is no automated `POST /agent/auth` on this origin (passive scanners should not invent one).

- **Anonymous public access:** fetch `/llms.txt`, `/openapi.json`, `/api/v1/blog`, and `/.well-known/*` with no credentials.
- **Human / commercial access:** register interest at [contact](https://mirrorsecurity.io/company/contact) or [book a demo](https://mirrorsecurity.io/book-a-demo). Those forms are Turnstile-gated.

## Step 3 — Tokens

`POST /oauth2/token` does not issue access tokens for the marketing site. Public read APIs ignore `Authorization`. `/.well-known/jwks.json` publishes an empty key set because this origin does not sign agent tokens.

## Step 4 — Call APIs

Prefer:

- [OpenAPI](https://mirrorsecurity.io/openapi.json)
- [API catalog](https://mirrorsecurity.io/.well-known/api-catalog)
- [Product docs](https://docs.mirrorsecurity.io/)
- [Enterprise platform](https://platform.mirrorsecurity.io/) (separate origin; follow that host's own auth.md if present)