# auth.md - Bikers Barber Club Agent Authentication & Registration Guide

Welcome to the autonomous agent interface for **Bikers Barber Club** (Tarija, Bolivia).

## 1. Overview
Bikers Barber Club provides public discovery endpoints, MCP server access, and REST APIs for autonomous AI agents, chatbots, and personal assistants (such as ChatGPT, Google Gemini, Claude, and Perplexity) to discover salon services, check real-time barber availability, and assist clients in scheduling appointments.

- **Issuer / Origin:** `https://bikersbarberclub.com`
- **API Base:** `https://bikersbarberclub.com/api/v2`
- **Documentation (OpenAPI):** `https://bikersbarberclub.com/api/openapi.json`
- **Agent Capabilities Manifest (ARD):** `https://bikersbarberclub.com/.well-known/ai-catalog.json`
- **MCP Server Card:** `https://bikersbarberclub.com/.well-known/mcp/server-card.json`

---

## 2. Public Read-Only Access (No Auth Required)
Autonomous agents can query public information without prior registration or credentials:
- **Services & Official Prices (BOB):** `GET /api/v2/services`
- **Barber Availability:** `GET /api/v2/availability?date=YYYY-MM-DD`
- **Store & Grooming Products:** `GET /api/v2/products`
- **API Health Status:** `GET /api/health`
- **LLM Context:** `GET /llms.txt` and `GET /llms-full.txt`

All public read endpoints support CORS (`Access-Control-Allow-Origin: *`) and accept standard `application/json` and `text/markdown`.

---

## 3. Agent Registration & Identity
If your agent requires elevated quotas, booking webhooks, or automated appointment creation on behalf of confirmed human users:

- **Registration Endpoint:** `POST https://bikersbarberclub.com/api/agents/register`
- **Supported Identity Types:** `agent`, `application`
- **Credential Types:** `api_key`, `bearer_token`
- **Token Claims / Verification:** `https://bikersbarberclub.com/api/agents/claim`
- **Revocation Endpoint:** `POST https://bikersbarberclub.com/api/agents/revoke`

### Registration Request Payload Example:
```json
{
  "agent_name": "MyAssistantBot",
  "developer_email": "developer@example.com",
  "client_uri": "https://agent.example.com",
  "requested_scopes": ["read:services", "read:availability", "create:appointment"]
}
```

---

## 4. OAuth 2.0 & Protected Resources
- **Authorization Server:** `https://bikersbarberclub.com/.well-known/oauth-authorization-server`
- **Protected Resource Metadata:** `https://bikersbarberclub.com/.well-known/oauth-protected-resource`
- **Supported Scopes:**
  - `read:services`: Access salon service catalog and prices.
  - `read:products`: Access retail product catalog and stock levels.
  - `read:availability`: Query barber schedule and working hours.
  - `create:appointment`: Submit customer booking request.

---

## 5. Rate Limits & Fair Use
- Unauthenticated requests: 40 requests / minute per IP.
- Registered agents: 120 requests / minute per API key.
- Please respect `robots.txt` directives and `Content-Signal` headers.

For human assistance or direct developer contact:
- **WhatsApp:** +591 75135111
- **Location:** Calle Daniel Campos entre 15 de Abril y La Madrid, Tarija, Bolivia.