# FindAffiliates auth.md

FindAffiliates exposes public agent-readable content without authentication. Agents can read `/llms.txt`, `/llms-full.txt`, Markdown page twins, the API catalog, and public agent skills directly. Protected user actions use user-mediated registration through Clerk.

## Public discovery

- API catalog: https://www.findaffiliates.online/.well-known/api-catalog
- Agent skills: https://www.findaffiliates.online/.well-known/agent-skills/index.json
- MCP server card: https://www.findaffiliates.online/.well-known/mcp/server-card.json
- OpenAPI: https://www.findaffiliates.online/openapi.json
- OAuth Protected Resource Metadata: https://www.findaffiliates.online/.well-known/oauth-protected-resource
- OAuth Authorization Server Metadata: https://www.findaffiliates.online/.well-known/oauth-authorization-server

## Agent registration

Registration is user mediated. Agents must send the user through the normal FindAffiliates browser sign-in flow and must not collect passwords, one-time codes, or raw session cookies directly.

Use this flow for bookmarks, account data, PRO access, program tracking, checkout, and other protected user actions:

1. Fetch https://www.findaffiliates.online/.well-known/oauth-protected-resource.
2. Fetch https://www.findaffiliates.online/.well-known/oauth-authorization-server and read the `agent_auth` block.
3. Use `agent_auth.register_uri` for registration instructions.
4. Open the relevant FindAffiliates workflow in a browser and let the user sign in with Clerk.
5. After the user signs in, perform protected actions only inside the user-approved browser session.

Supported identity types:

- `identity_assertion`

Supported subject types:

- `human_user`
- `browser_agent`

Supported credential types:

- `oauth2_authorization_code`
- `openid_connect_id_token`
- `clerk_session_cookie`
- `bearer_access_token`

Supported claims:

- `sub`
- `email`
- `email_verified`
- `name`

Machine-readable registration summary:

```json
{
  "agent_auth": {
    "skill": "https://www.findaffiliates.online/auth.md",
    "register_uri": "https://www.findaffiliates.online/auth.md",
    "identity_endpoint": "https://www.findaffiliates.online/auth.md",
    "claim_endpoint": "https://www.findaffiliates.online/auth.md#claim-and-consent",
    "events_endpoint": "https://www.findaffiliates.online/auth.md#revocation",
    "registration_flow": "user_mediated_oauth",
    "identity_types_supported": ["identity_assertion"],
    "supported_identity_types": ["identity_assertion"],
    "subject_types_supported": ["human_user","browser_agent"],
    "identity_assertion": {
      "assertion_types_supported": ["urn:ietf:params:oauth:token-type:id-jag","verified_email"],
      "credential_types_supported": ["oauth2_authorization_code","openid_connect_id_token","clerk_session_cookie","bearer_access_token"]
    },
    "credential_types_supported": ["oauth2_authorization_code","openid_connect_id_token","clerk_session_cookie","bearer_access_token"],
    "claims_supported": ["sub","email","email_verified","name"],
    "claim_url": "https://www.findaffiliates.online/auth.md#claim-and-consent",
    "revocation_url": "https://www.findaffiliates.online/auth.md#revocation",
    "events_supported": ["https://schemas.workos.com/events/agent/auth/identity/assertion/revoked"]
  }
}
```

## Claim and consent

FindAffiliates does not expose a device-code claim ceremony or anonymous agent account claiming endpoint. The claim step is the signed-in browser session controlled by Clerk and the user's explicit action on the requested page.

Agents that only know the user's email should open the requested FindAffiliates workflow and let the user authenticate there. Do not ask the user to send passwords, verification codes, or cookies back to the agent.

## Credential use

The OAuth and OIDC issuer is Clerk:

- Issuer: https://clerk.findaffiliates.online
- Authorization endpoint: https://clerk.findaffiliates.online/oauth/authorize
- Token endpoint: https://clerk.findaffiliates.online/oauth/token
- Userinfo endpoint: https://clerk.findaffiliates.online/oauth/userinfo
- JWKS: https://clerk.findaffiliates.online/oauth/jwks

Public content does not need credentials. Protected browser actions rely on the user's signed-in Clerk session and the app's normal authorization checks.

## Revocation

FindAffiliates does not expose an agent-callable OAuth token revocation endpoint yet. Users can end browser access by signing out of FindAffiliates and clearing the browser session used by the agent. For server-to-server access removal or account help, contact findaffiliatescontact@gmail.com.

## Server-to-server access

Unattended server-to-server agent access is not self-service yet. For integrations, contact findaffiliatescontact@gmail.com with the product name, callback URL, requested scopes, and intended use.

## Payment and commerce

FindAffiliates supports card checkout through the existing website flows. The site does not currently expose x402 wallet payments. Commerce discovery is available at https://www.findaffiliates.online/.well-known/acp.json and https://www.findaffiliates.online/.well-known/ucp.

## Policies

- Privacy policy: https://www.findaffiliates.online/privacy-policy
- Terms of service: https://www.findaffiliates.online/terms-of-service