# auth.md

You are an agent. **3Delicious.net** supports agentic registration for catalog and model access. Resource server: `https://3delicious.net/`. Authorization server: `https://3delicious.net/` (same host).

## Step 1 — Discover

On `HTTP 402` or `HTTP 401`, read `WWW-Authenticate: Bearer resource_metadata="https://3delicious.net/.well-known/oauth-protected-resource"`.

### 1a. Protected Resource Metadata

```http
GET https://3delicious.net/.well-known/oauth-protected-resource
```

```json
{
  "resource": "https://3delicious.net/",
  "resource_name": "3Delicious.net 3D Model Catalog",
  "authorization_servers": ["https://3delicious.net"],
  "scopes_supported": ["catalog:read", "model:read", "download"],
  "bearer_methods_supported": ["header"]
}
```

### 1b. Authorization Server metadata (`agent_auth`)

```http
GET https://3delicious.net/.well-known/oauth-authorization-server
```

Read the full `agent_auth` block: `skill`, `register_uri`, `claim_uri`, `revocation_uri`, `identity_types_supported`, `anonymous`, `identity_assertion`, `events_supported`.

| Field | Value |
|-------|--------|
| `skill` | `https://3delicious.net/auth.md` |
| `register_uri` | `https://3delicious.net/agent/auth` |
| `claim_uri` | `https://3delicious.net/agent/auth/claim` |
| `revocation_uri` | `https://3delicious.net/agent/auth/revoke` |
| `identity_types_supported` | `anonymous`, `identity_assertion` |

## Step 2 — Pick a method

1. **Per-request payment (no account)** → `anonymous` + `access_token` via x402 `PAYMENT-SIGNATURE` or `POST /x402/verify`.
2. **Subscription API key** → `identity_assertion` + `verified_email`, or `anonymous` + `api_key` (email provisioning).
3. **Public discovery only** → no credential; use `llms.txt`, `/.well-known/api-catalog`, `/x402/card/{hash}.json`.

Cross-check your choice against `agent_auth.*_supported` before sending.

## Step 3 — Register

### anonymous + access_token (x402, no signup)

```http
POST https://3delicious.net/agent/auth
Content-Type: application/json

{
  "type": "anonymous",
  "requested_credential_type": "access_token"
}
```

Response includes `instructions` for `PAYMENT-SIGNATURE` and `https://3delicious.net/x402/verify`. Use the token as `Authorization: Bearer <access_token>` or send `PAYMENT-SIGNATURE` per request.

### anonymous + api_key (email provisioning)

```http
POST https://3delicious.net/agent/auth
Content-Type: application/json

{
  "type": "anonymous",
  "requested_credential_type": "api_key"
}
```

Then email **3delicious@pm.me** from your address with your use case. Send the key as `X-API-Key: x402_...` on each request.

### identity_assertion + verified_email

```http
POST https://3delicious.net/agent/auth
Content-Type: application/json

{
  "type": "identity_assertion",
  "assertion_type": "verified_email",
  "assertion": "user@example.com",
  "requested_credential_type": "api_key"
}
```

Response returns `post_claim_scopes` and instructions to email **3delicious@pm.me** from that address. Automated OTP claim is not enabled.

## Step 4 — Claim ceremony

`POST https://3delicious.net/agent/auth/claim` and `POST https://3delicious.net/agent/auth/claim/complete` return `501 claim_not_automated`. Use email to **3delicious@pm.me** for API key provisioning.

## Step 5 — Use the credential

```http
GET https://3delicious.net/model/Example-Name/abc12345
Authorization: Bearer <access_token>
```

Or:

```http
PAYMENT-SIGNATURE: <base64 EIP-3009 payload>
X-API-Key: x402_...
```

On `401` for a previously working credential, drop it and restart at Step 1.

## Errors

| Code | Action |
|------|--------|
| `unsupported_credential_type` | Use `api_key` or `access_token` for anonymous |
| `issuer_not_enabled` | ID-JAG not supported; use `verified_email` or `anonymous` |
| `claim_not_automated` | Email 3delicious@pm.me |
| `revocation_manual` | Email 3delicious@pm.me to revoke API keys |

## Revocation

API keys: email **3delicious@pm.me**. x402 payment authorizations are single-use. Provider `logout+jwt` to `https://3delicious.net/agent/auth/revoke` is not enabled.

## Support

- Docs: https://3delicious.net/x402/docs.html
- Pricing: https://3delicious.net/x402/pricing.json
- Email: 3delicious@pm.me