# auth.md

Agent registration and credentials for https://blvigil.com (Vigil). Machine-readable companions: https://blvigil.com/.well-known/api-catalog, https://blvigil.com/openapi.json, https://blvigil.com/.well-known/mcp/server-card.json.

## Agent audience

Automated agents, crawlers and MCP clients that read Vigil's public pages or call the agent endpoints on this host: `/agent/site.json`, `/agent/search`, `/agent/read` and the MCP endpoint `POST /mcp`.

## Registration and provisioning endpoints

- Registration endpoint: none. Agents do not register with this host and nothing here creates agent accounts.
- Provisioning endpoint: none for agents. Every agent-facing endpoint on this host is open.
- OAuth Authorization Server metadata and Protected Resource Metadata are intentionally not published: no authorization server exists for these endpoints, so publishing one would be false.

## Supported methods

| Method | Supported | Notes |
|---|---|---|
| anonymous | yes | default for every endpoint on this host; rate limited per client |
| identity assertion (ID-JAG) | no | no authorization server |
| verified email | no | not required for read access |
| Web Bot Auth signed requests (RFC 9421) | accepted, optional | send `Signature-Agent`, `Signature-Input` and `Signature`; this site's own bot key directory is https://blvigil.com/.well-known/http-message-signatures-directory |

## Credential use

No credential is required or issued for `/agent/*`, `/mcp`, `/openapi.json`, `/llms.txt` and the pages in the sitemap. Send a descriptive `User-Agent` and stay under one request per second; over-limit clients receive HTTP 429.

## Buying (agents)

Agents can buy from this store without an account, a registration or an API key.

1. Read the catalog: `GET https://blvigil.com/agent/commerce/products`. Prices, billing intervals and free trials are read from Stripe; each offer shows live availability.
2. Create a checkout session for one offer, through any of: UCP (profile https://blvigil.com/.well-known/ucp, `POST https://blvigil.com/agent/commerce/ucp/checkout-sessions`), ACP (discovery https://blvigil.com/.well-known/acp.json, `POST https://blvigil.com/agent/commerce/acp/checkout_sessions`), or the MCP tool `create_checkout` on https://blvigil.com/mcp.
3. The session answers `status: requires_escalation` with a `continue_url`. Send the buyer there: it opens the Stripe-hosted checkout page, where the buyer pays and enters an email (and a shipping address for hardware). The store's usual receipt and delivery follow.

| Payment path | Accepted | Notes |
|---|---|---|
| buyer pays on the Stripe-hosted checkout page via `continue_url` | yes | the payment path today |
| payment instruments sent to the checkout API | no | UCP and ACP complete calls return the session with its `continue_url` |
| delegated payment tokens (Stripe Shared Payment Tokens) | no | not enabled on this store |
| MPP HTTP 402 payment credentials | no | not enabled on this store |
| x402 | no | not enabled on this store |
| AP2 mandates | no | no A2A merchant agent |

Guide: https://blvigil.com/agent/skills/buy-products/SKILL.md

## Contact and removal

https://blvigil.com/support