# auth.md

You are an agent shopping or reading Ippodo Tea Co. at https://ippodotea.com.
This file is the Auth.md discovery document for agent registration and credential use.

## Audience

- Catalog, quizzes, `/llms.txt`, `/agents.md`, and UCP cart MCP are **anonymous**. Do not register an Ippodo account to browse or build a cart.
- Checkout, orders, and the Customer Account API require a **human buyer**. Prefer [https://shop.app/SKILL.md](https://shop.app/SKILL.md) (Shop Pay) or UCP `continue_url`. Do not complete payment without contemporaneous buyer approval.

## Discover

1. Protected resource metadata: `GET https://ippodotea.com/.well-known/oauth-protected-resource`
2. Authorization server metadata: `GET https://ippodotea.com/.well-known/oauth-authorization-server` (Shopify Customer Account; includes `agent_auth`)
3. Commerce discovery: `GET https://ippodotea.com/.well-known/ucp` then MCP `tools/list` on the advertised endpoint (`https://ippodotea.com/api/ucp/mcp`)

## Registration methods

### anonymous (catalog and cart)

No credential. Call UCP/MCP cart tools without `Authorization`. Use this for search, product lookup, and cart construction.

### identity_assertion (buyer checkout)

Shopify Customer Account OAuth (authorization code + PKCE, and JWT-bearer). Register at the `agent_auth.register_uri` from authorization-server metadata. Supported assertion types include `verified_email` and `urn:ietf:params:oauth:token-type:id-jag` when the buyer's identity provider can mint one. Send bearer tokens in the `Authorization` header.

### claim (Shop Pay / hosted checkout)

If you cannot complete OAuth, send the buyer to UCP `continue_url` or Shop Pay. The claim URL is the hosted checkout the buyer confirms in their own browser.

## Do not

- POST to invent Ippodo agent accounts, passwords, or API keys.
- Cache access tokens or treat catalog JSON as a credential.
- Call `complete_checkout` unless status is `ready_for_complete` and the buyer approved.