# Auth.md

## A&L Systems — Agent Authentication

This document describes how AI agents and automated clients can authenticate
with A&L Systems services. It follows the auth.md convention
(https://github.com/workos/auth.md).

## Site

- Name: A&L Systems
- Origin: https://al-systems.co.uk
- Contact: info@al-systems.co.uk

## Authentication

Authentication uses OAuth 2.1 with PKCE. Agents should discover endpoints via:

- OAuth Authorization Server Metadata: https://al-systems.co.uk/.well-known/oauth-authorization-server
- OAuth Protected Resource Metadata: https://al-systems.co.uk/.well-known/oauth-protected-resource
- API Catalog (RFC 9727): https://al-systems.co.uk/.well-known/api-catalog

## Endpoints

- Issuer: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1
- Authorization: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1/authorize
- Token: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1/token
- Dynamic Client Registration: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1/oauth/clients/register
- JWKS: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1/.well-known/jwks.json
- Userinfo / Claims: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1/user
- Revocation / Logout: https://rxcvxsltjrfiedsanpfk.supabase.co/auth/v1/logout

## Identity Types

- human — interactive end users
- agent — autonomous AI agents acting on behalf of a user

## Credential Types

- oauth2_authorization_code (PKCE required, S256)
- oauth2_refresh_token

## Scopes

- openid
- email
- profile

## Registration

Agents may self-register as OAuth clients via the Dynamic Client Registration
endpoint above (RFC 7591). Provide redirect_uris and client_name. Public
clients using PKCE do not require a client secret.

## Protected Resources

- MCP Server: https://al-systems.co.uk/mcp

## Contact

For agent onboarding, integration questions, or credential issues, email
info@al-systems.co.uk.