# auth.md: agent authentication for Comfort Scrub

This document tells an autonomous agent how to get credentials for Comfort Scrub. It is the human-readable companion to `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server`.

## What is open without credentials

These need no token. Read them first; most questions are answered here.

- `https://comfortscrub.com/llms.txt`: what this site is and does
- `https://comfortscrub.com/openapi.json`: the machine-readable API description
- `https://comfortscrub.com/.well-known/api-catalog`: every API this origin publishes
- `https://comfortscrub.com/wp-json/wc/store/v1/products`: live products, prices and stock

## Registration flow

The whole recipe. Nothing outside this document is needed to follow it.

### 1. Discover

- Authorization server metadata: `https://comfortscrub.com/.well-known/oauth-authorization-server`
- Protected resource metadata: `https://comfortscrub.com/.well-known/oauth-protected-resource`

### 2. Register

There is no self-service registration, and that is deliberate: this is someone's WordPress site, and access is granted by a person rather than claimed by software.

Ask the site administrator for an **application password**. They create one at `https://comfortscrub.com/wp-admin/profile.php#application-passwords-section`, under Users → Profile → Application Passwords, and give you the generated value. It is shown once.

### 3. Claim

An application password is live the moment it is created. There is no approval step to wait on, and no polling to do.

### 4. Exchange

There is no token exchange. The application password IS the credential, presented as HTTP Basic auth:

```http
GET https://comfortscrub.com/wp-json/wp/v2/users/me
Authorization: Basic base64(username:application-password)
```

A `200` with your user object means the credential works.

### 5. Use

Send the same header to any endpoint in `/openapi.json`. What you may read and change is whatever the WordPress user it belongs to may read and change, so ask for an account with the least access that does the job.

### 6. Handle revocation

A revoked password fails with `401`. Application passwords are revoked from the same screen they are created on, and revocation takes effect immediately. Ask for a new one; do not retry a dead credential in a loop.

## Identity and rate limits

- Send a descriptive `User-Agent` naming the operator and a contact URL.
- If you sign requests, publish your keys per Web Bot Auth and send `Signature-Agent`; signed traffic is treated as identified rather than anonymous.

## Contact

- Email `MMSCRUBS1@YAHOO.COM` to request access, report abuse, or have a credential revoked.

## Content use

Content signals for this site are declared in `https://comfortscrub.com/robots.txt` as `Content-Signal: ai-train=no, search=yes, ai-input=yes`. Honour them.