# auth.md - Chatofy Agent Registration & Authentication Specification

> Auth.md specification declaring agent authentication, registration workflows, credential management, and OAuth protected resource metadata for Chatofy APIs.

## Overview & Target Audience

Chatofy welcomes automated AI agents, integrations, and autonomous assistants. Agents can register for API access, provision API keys (`cfy_sk_live_...`), and interact with Chatofy messaging services.

## Authentication Methods

Chatofy supports the following primary agent authentication methods:

1. **Bearer API Tokens** (`header`):
   Agents pass API tokens in HTTP request headers:
   ```http
   Authorization: Bearer cfy_sk_live_YOUR_API_KEY
   ```

2. **OAuth 2.0 Protected Resource**:
   - **Protected Resource Metadata**: https://chatofy.in/.well-known/oauth-protected-resource
   - **Authorization Server Metadata**: https://chatofy.in/.well-known/oauth-authorization-server
   - **Resource Host**: https://app.chatofy.in
   - **Bearer Methods Supported**: `["header"]`
   - **Scopes**: `["read", "write", "messages", "contacts"]`

## Agent Registration & Provisioning Endpoints

Agents can register or provision access programmatically:

- **Anonymous / Instant Ingestion Endpoint**:
  - `POST https://app.chatofy.in/api/public/leads`
  - Body: `{ "full_name": "Agent Name", "email": "agent@domain.com", "use_cases": ["Automation"] }`
- **Dashboard Provisioning**:
  - Generate production API keys at `https://app.chatofy.in/dashboard/settings/api`

## Agent Auth & Flow Metadata

- **Identity Types Supported**: `["anonymous", "identity_assertion"]`
- **Assertion Types Supported**: `["verified_email", "urn:ietf:params:oauth:token-type:id-jag"]`
- **Credential Types**: `["bearer_token", "api_key"]`
- **Register & Claim URI**: https://app.chatofy.in/api/public/leads
- **Machine Instructions**: https://chatofy.in/llms.txt
- **API Catalog**: https://chatofy.in/.well-known/api-catalog