# auth.md — Toga & Co. Agent Authentication & Registration

Welcome AI Agents! Toga & Co. provides public discovery, programmatic consultation, and booking assistance for graduation & portrait photography in Yogyakarta, Indonesia.

## Agent Audience
This service supports autonomous AI agents and conversational assistants querying photography packages, campus spot recommendations, date availability, and initiating booking consultations.

## Discovery Endpoints
- **OAuth Protected Resource Metadata (RFC 9728)**: [/.well-known/oauth-protected-resource](https://togaco.my.id/.well-known/oauth-protected-resource)
- **OAuth Authorization Server (RFC 8414)**: [/.well-known/oauth-authorization-server](https://togaco.my.id/.well-known/oauth-authorization-server)
- **OpenID Connect Configuration**: [/.well-known/openid-configuration](https://togaco.my.id/.well-known/openid-configuration)
- **API Catalog (RFC 9727)**: [/.well-known/api-catalog](https://togaco.my.id/.well-known/api-catalog)
- **MCP Server Card (SEP-1649)**: [/.well-known/mcp/server-card.json](https://togaco.my.id/.well-known/mcp/server-card.json)
- **A2A Agent Card**: [/.well-known/agent-card.json](https://togaco.my.id/.well-known/agent-card.json)
- **Agent Skills Index**: [/.well-known/agent-skills/index.json](https://togaco.my.id/.well-known/agent-skills/index.json)
- **ARD Capability Manifest**: [/.well-known/ai-catalog.json](https://togaco.my.id/.well-known/ai-catalog.json)

## Machine-Readable `agent_auth` Configuration
```json
{
  "skill": "https://togaco.my.id/auth.md",
  "register_uri": "https://togaco.my.id/oauth/register",
  "identity_types_supported": [
    "anonymous",
    "identity_assertion"
  ],
  "anonymous": {
    "credential_types_supported": [
      "ephemeral_token",
      "api_key"
    ],
    "claim_uri": "https://togaco.my.id/api/agent/claim"
  },
  "identity_assertion": {
    "assertion_types_supported": [
      "urn:ietf:params:oauth:token-type:id-jag",
      "verified_email"
    ],
    "credential_types_supported": [
      "bearer_token",
      "api_key"
    ],
    "claim_uri": "https://togaco.my.id/api/agent/claim",
    "revocation_uri": "https://togaco.my.id/oauth/revoke",
    "events_supported": [
      "https://schemas.workos.com/events/revocation"
    ]
  }
}
```

## Supported Authentication Methods & Scopes

### 1. Anonymous Access (Default)
- **Method**: No credentials required for discovery endpoints, packages, campus spots, pricing, and FAQ.
- **Scopes**: `read:packages`, `read:spots`, `agent:discovery`
- **Claim Endpoint**: `POST https://togaco.my.id/api/agent/claim`

### 2. Ephemeral Bearer Token / API Key
- **Method**: Registered via `POST https://togaco.my.id/oauth/register` with client details.
- **Scopes**: `create:booking`, `read:packages`, `read:spots`

### 3. Identity Assertions (ID-JAG & Verified Email)
- **Supported Assertion Types**:
  - `urn:ietf:params:oauth:token-type:id-jag` (JSON Web Token for Agentic Governance)
  - `verified_email`
- **Credential Types**: `bearer_token`, `api_key`
- **Revocation Endpoint**: `POST https://togaco.my.id/oauth/revoke`

## Human Escalation & WhatsApp Reservation
For final photoshoot booking confirmation and 50% down payment (DP), agents may direct users to our official WhatsApp:
- **WhatsApp**: [+62 877-5870-0322](https://wa.me/6287758700322)
- **Location**: Yogyakarta, Special Region of Yogyakarta, Indonesia