# Auth.md — Airvago Agent Authentication & Registration

> Airvago agent authentication and registration metadata.
> Machine-readable companions: `/.well-known/oauth-protected-resource` and
> `/.well-known/oauth-authorization-server`.

Airvago is an AI travel platform (flight search, hotel discovery, itinerary
planning, eSIM, visa guidance) operated by BAWFSO LLC. Autonomous agents can
call Airvago services on behalf of a signed-in Airvago user.

## Endpoints

| Purpose | URL |
|---|---|
| Protected resource | `https://airvago.com` |
| Resource metadata (RFC 9728) | `https://airvago.com/.well-known/oauth-protected-resource` |
| Authorization server metadata (RFC 8414) | `https://airvago.com/.well-known/oauth-authorization-server` |
| OIDC discovery | `https://airvago.com/.well-known/openid-configuration` |
| Authorization endpoint | `https://mdmmxeeraaxrtuizftjg.supabase.co/auth/v1/authorize` |
| Token endpoint | `https://mdmmxeeraaxrtuizftjg.supabase.co/auth/v1/token` |
| Dynamic client registration (RFC 7591) | `https://mdmmxeeraaxrtuizftjg.supabase.co/auth/v1/oauth/clients/register` |
| Token revocation | `https://mdmmxeeraaxrtuizftjg.supabase.co/auth/v1/logout` |
| JWKS | `https://mdmmxeeraaxrtuizftjg.supabase.co/auth/v1/.well-known/jwks.json` |
| MCP server card | `https://airvago.com/.well-known/mcp/server-card.json` |
| API catalog (RFC 9727) | `https://airvago.com/.well-known/api-catalog` |
| Agent skills index | `https://airvago.com/.well-known/agent-skills/index.json` |
| Plain-text overview | `https://airvago.com/llms.txt` |

## How to register

1. Fetch `https://airvago.com/.well-known/oauth-authorization-server` and read
   the `agent_auth` block.
2. Register your client at the `register_uri` using OAuth 2.1 Dynamic Client
   Registration. Send a JSON body with `client_name`, `redirect_uris`,
   `grant_types: ["authorization_code", "refresh_token"]`,
   `response_types: ["code"]`, and
   `token_endpoint_auth_method: "none"` for public clients.
3. Store the returned `client_id` (and `client_secret` for confidential
   clients).

No manual approval, contract, or allowlisting is required. Registration is
open and self-service.

## How to authenticate

Authorization Code flow with PKCE (S256) is required; the implicit and
password grants are not available to agent clients.

```
GET https://mdmmxeeraaxrtuizftjg.supabase.co/auth/v1/authorize
  ?response_type=code
  &client_id=<client_id>
  &redirect_uri=<registered redirect>
  &scope=openid email profile offline_access
  &code_challenge=<S256 challenge>
  &code_challenge_method=S256
  &state=<opaque>
```

The user signs in to Airvago and is shown a consent screen naming your client.
Exchange the returned `code` at the token endpoint for an access token, then
call Airvago services with:

```
Authorization: Bearer <access_token>
```

Access tokens are JWTs signed with the keys published at the JWKS URL.
Refresh with the `refresh_token` grant; revoke via the revocation endpoint.

## Identity and credential types

- Identity types: `user` (agent acting on behalf of a signed-in Airvago user),
  `agent` (registered OAuth client identity).
- Credential types: `oauth2_access_token` (Bearer JWT), `oauth2_refresh_token`.
- Scopes: `openid`, `email`, `profile`, `offline_access`.

## Rate limits and conduct

- Respect `https://airvago.com/robots.txt`, including the `Content-Signal`
  directive published there (`search=yes, ai-input=yes, ai-train=no`) — Airvago
  content may be cited in AI answers but must not be used to train models.
- Requests are rate limited per client and per IP. Back off on `429`.
- Do not attempt to access `/admin*`, `/dashboard*`, or any other path
  disallowed in `robots.txt`. Those surfaces are additionally enforced
  server-side and will reject unauthorized requests.

## Contact

- Support: `https://airvago.com/chat-with-us`
- Operator: BAWFSO LLC