# auth.md

Agents can register with the Bangkok IVF Guide without a user account. The guide is public. A token identifies the agent. It does not grant access to private records, because the guide does not keep patient accounts.

## Audience

Automated agents that search or quote this guide.

## Supported method

Anonymous registration. Send `identity_type` as `anonymous`. Verified-email and identity-assertion registration are not offered.

## Register

[POST https://bangkokivf.com/oauth/register](https://bangkokivf.com/oauth/register)

```json
{
  "client_name": "Example Agent",
  "identity_type": "anonymous"
}
```

The response includes `client_id` and `client_secret`. Registration is also the claim step: there is no later user-binding ceremony, so `claim_uri` is this same URL.

## Token

[POST https://bangkokivf.com/oauth/token](https://bangkokivf.com/oauth/token) with `Content-Type: application/x-www-form-urlencoded`.

```
grant_type=client_credentials&scope=content:read
```

Send the client credentials with HTTP Basic authentication, or as `client_id` and `client_secret` form fields.

The response is a bearer access token. The scope is `content:read`. Tokens expire after one hour. Register again to mint a new client, then request a new token.

## Use

```
Authorization: Bearer <access_token>
```

Use it on [GET https://bangkokivf.com/api/content](https://bangkokivf.com/api/content) and [GET https://bangkokivf.com/api/content/search](https://bangkokivf.com/api/content/search). Requests without a token are allowed. An invalid token receives `401` and a `WWW-Authenticate` header pointing at the protected resource metadata.

## Discovery

- [Protected resource metadata](https://bangkokivf.com/.well-known/oauth-protected-resource)
- [Authorization server metadata](https://bangkokivf.com/.well-known/oauth-authorization-server)
- [Signing keys](https://bangkokivf.com/.well-known/jwks.json)
- [API catalog](https://bangkokivf.com/.well-known/api-catalog)