# auth.md

You are an agent. This file explains authentication for oblique.markets.

## The short version
There are no user accounts and no API keys. Two independent rails:
1. **Payment (x402, no token ever needed):** paid endpoints under https://api.oblique.markets/api/v1/paid/* answer HTTP 402 with a machine-readable quote; pay in USDC on Base (eip155:8453) or Solana and retry with the payment header.
2. **Identity (optional, auth.md agentic registration — anonymous flow):** register anonymously at the identity endpoint, receive a service-signed identity assertion, exchange it for a Bearer access_token. The token gives you a persistent agent identity (introspect it at /agent/identity/me); it never substitutes for payment.

## Discovery
- x402 catalog: https://oblique.markets/.well-known/x402.json
- OpenAPI: https://oblique.markets/openapi.json
- Agent card: /.well-known/agent-card.json
- OAuth Protected Resource Metadata: https://oblique.markets/.well-known/oauth-protected-resource (authoritative)
- Authorization Server metadata: https://oblique.markets/.well-known/oauth-authorization-server (carries the agent_auth block)
- Free observer of this operation: https://remote.observer

## Registration
Agentic registration is supported, **anonymous flow only**. Discover → register → exchange → use:

1. **Discover.** `GET https://oblique.markets/.well-known/oauth-protected-resource` names the authorization server; `GET https://oblique.markets/.well-known/oauth-authorization-server` carries the `agent_auth` block (issuer, token_endpoint, revocation_endpoint, jwks_uri).
2. **Register.** `POST https://oblique.markets/agent/identity` with body `{"type": "anonymous"}` → `registration_id` + a service-signed `identity_assertion` (ES256, 30 days, verifiable against /.well-known/jwks.json).
3. **Exchange.** `POST https://oblique.markets/oauth2/token` (form-encoded) with `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<identity_assertion>` → `access_token` (Bearer, 1 hour, scope `agent.read`). Re-exchange the same assertion for fresh tokens until it expires.
4. **Use.** `GET https://oblique.markets/agent/identity/me` with `Authorization: Bearer <access_token>` returns your registration. Revoke any token at `POST /oauth2/revoke` (RFC 7009).

**Honesty boundaries:** `identity_assertion` registration returns `issuer_not_enabled` (the provider trust list is empty) and `service_auth` returns `service_auth_not_enabled` (no user accounts). The claim ceremony endpoint exists but rejects every request with `invalid_claim_token` — no claim token is ever issued, because there is no user account a registration could be claimed into. Registrations stay anonymous for their full lifetime (200 days).

**What the token is NOT:** payment. Paid endpoints ignore Bearer tokens entirely — the x402 payment header is the only thing that buys a response.

## Identity flows
Supported: anonymous (full flow above). Not supported: identity_assertion, service_auth — there are no user accounts and the provider trust list is empty.

```yaml
agent_auth:
  skill: https://oblique.markets/auth.md
  identity_endpoint: https://oblique.markets/agent/identity
  register_uri: https://oblique.markets/agent/identity
  claim_endpoint: https://oblique.markets/agent/identity/claim
  identity_types_supported: ["anonymous"]
  anonymous:
    credential_types_supported: ["urn:ietf:params:oauth:token-type:jwt"]
    claim_uri: https://oblique.markets/agent/identity/claim
```

## Contact
Operator surfaces: https://oblique.markets · field notes: https://x.com/obliquemarkets