<!-- Generated by scripts/i18n/translate.py from public/auth.md. Do not edit by hand: the next sync overwrites it. -->
# auth.md — Mauritius Yokoyama Issei Portfolio

This document describes how AI agents can authenticate (or consume without need of credentials) the public data of this portfolio.

## Protected resources

- Resource: `https://mauricio.issei.com.br`
- Authorization Server: `https://mauricio.issei.com.br` (metadata in `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration`)
- Protected Resource Metadata: `/.well-known/oauth-protected-resource`
- Available Scopes: `cv:read`, `projects:read`, `profile`
- Token presentation method: `header` (Bearer)

## Agent log

The above scopes expose only public reading data (curriculum, projects, profile). No registration of credentials is required for reading consumption:

```json
{
  "identity_types_supported": ["anonymous"],
  "anonymous": {
    "credential_types_supported": ["none"]
  },
  "claim_uri": "https://mauricio.issei.com.br/.well-known/oauth-protected-resource"
}
```

## agent auth

```json
{
  "agent_auth": {
    "skill": "portfolio-read",
    "register_uri": "https://mauricio.issei.com.br/.well-known/oauth-protected-resource",
    "methods": [
      {
        "type": "anonymous",
        "scopes": ["cv:read", "projects:read", "profile"]
      }
    ]
  }
}
```

## OAuth metadata scope

The `/.well-known/openid-configuration` and `/.well-known/oauth-authorization-server` documents exist for discovery compliance (RFC 8414 / OIDC Discovery) and for loading the `agent_auth` block. They are. **declarations**: there is no authority serving in this field.

- No token is issued. `authorization_endpoint` e `token_endpoint` are declared by format requirement, but **do not respond** — do not try to run `authorization_code` or `implicit`.
- `jwks_uri` solves for an empty set of keys (`{"keys": []}`), which is the truth: nothing is signed because nothing is issued.
- The real access model is declared in `agent_auth`: **anônimo**, `credential_types supported: ["none"]`. Basta fazer `GET` in resources.

For MCP server and tool details, see `/.well-known/mcp/server-card.json` — attention to `status` field: HTTP endpoint in `/mcp` is still **planned**. Today the tools run on their own website via WebMCP (`navigator.modelContext`), and all features are accessible by HTTPS directly.