# auth.md

How an agent authenticates with uranus.com.br.

**Short answer: it does not have to.** Every published surface is a public read.
Send no `Authorization` header and the call succeeds.

## Audience

Autonomous agents, crawlers and scripts calling the Uranus Technologies content
API, the markdown mirrors, or the MCP server.

## Registration

There is none, and none is required. Registration endpoints exist so that
discovery resolves instead of 404ing, and they refuse every request:

| Endpoint | Answer |
| --- | --- |
| `POST https://uranus.com.br/oauth/register` | `403 access_denied` — nothing to register for |
| `GET https://uranus.com.br/oauth/claim` | `200` — the anonymous identity, already granted |
| `POST https://uranus.com.br/oauth/token` | `400 unauthorized_client` — no token is issued |
| `GET https://uranus.com.br/oauth/authorize` | `400 invalid_request` — no code is issued |
| `GET https://uranus.com.br/oauth/jwks` | `200 {"keys": []}` — nothing is signed |
| `POST https://uranus.com.br/oauth/revoke` | `200` — no token can be outstanding |

Every one answers JSON in the RFC 6749 error shape, with an `error_description`
naming the call that does work.

## Supported method

`anonymous`. Credential type `none`.

```http
GET /api/v1/products HTTP/1.1
Host: uranus.com.br
Accept: application/json
```

## Credential use

No credential is issued, stored or validated. The `scopes_supported` advertised
in the metadata below name reads that are already public
(`content:read`, `products:read`, `posts:read`, `company:read`); they are
declared so an authorization request has real values to carry if a Uranus
resource ever starts requiring one. Nothing checks them today.

## Rate limits

`600` requests per 60 seconds per client address, reported on every response
with `RateLimit`, `RateLimit-Policy` and the discrete
`RateLimit-Limit` / `RateLimit-Remaining` / `RateLimit-Reset` triple. A
throttled reply is `429` with `Retry-After` and an RFC 9457 problem document.

## Discovery

- Authorization server metadata (RFC 8414): https://uranus.com.br/.well-known/oauth-authorization-server
- Protected resource metadata (RFC 9728): https://uranus.com.br/.well-known/oauth-protected-resource
- Capability manifest (ARD): https://uranus.com.br/.well-known/ai-catalog.json
- MCP server card: https://uranus.com.br/.well-known/mcp.json
- OpenAPI 3.1: https://uranus.com.br/openapi.json
- Human documentation: https://uranus.com.br/developers

## If this page ever changes

A Uranus resource that starts requiring a token will say so here first, and will
announce it with the `Deprecation` and `Sunset` headers described at
https://uranus.com.br/developers#deprecation before changing any existing endpoint's behaviour.