# auth.md

MakeItLast is a public software catalog. Agents can read listings without an account. Humans who want to submit or manage a listing sign in at https://www.makeitla.st/login with Google or an email magic link.

## Audience

- Agents that search, cite, or summarize live listings.
- Makers who list a product and optionally verify a dofollow badge.

## Public catalog (no token)

These endpoints do not require OAuth or a session:

- JSON catalog: https://www.makeitla.st/api/catalog
- One listing: https://www.makeitla.st/api/catalog/{slug}
- Health: https://www.makeitla.st/api/health
- Markdown catalog: https://www.makeitla.st/llms.txt
- OpenAPI: https://www.makeitla.st/openapi.json
- MCP: https://www.makeitla.st/mcp

Ask for `Accept: text/markdown` on HTML pages to get a markdown twin.

## Discovery

1. Fetch protected resource metadata: `GET /.well-known/oauth-protected-resource`.
2. Fetch authorization server metadata: `GET /.well-known/oauth-authorization-server`.
3. Read the `agent_auth` block. For catalog read, stop there. Use scope `catalog:read` only as a label. Do not send a bearer token.
4. DNS-AID names: `_index._agents.makeitla.st`, `_a2a._agents.makeitla.st`, `_mcp._agents.makeitla.st`. Zone file: `/.well-known/dns-aid.json`.

```json
{
  "skill": "https://www.makeitla.st/auth.md",
  "register_uri": "https://www.makeitla.st/agent/auth",
  "identity_endpoint": "https://www.makeitla.st/agent/auth",
  "claim_uri": "https://www.makeitla.st/agent/auth",
  "claims_url": "https://www.makeitla.st/agent/auth",
  "revocation_uri": "https://www.makeitla.st/oauth/revoke",
  "revocation_url": "https://www.makeitla.st/oauth/revoke",
  "identity_types_supported": [
    "anonymous"
  ],
  "supported_identity_types": [
    "anonymous"
  ],
  "credential_types_supported": [
    "none"
  ],
  "anonymous": {
    "credential_types_supported": [
      "none"
    ],
    "claim_uri": "https://www.makeitla.st/agent/auth"
  }
}
```

## Registration

Supported identity type: anonymous. Supported credential type: none. Anonymous catalog access is already granted. There is no agent client registration and no access token to mint for public read.

- skill: https://www.makeitla.st/auth.md
- register_uri: https://www.makeitla.st/agent/auth
- claim_uri: https://www.makeitla.st/agent/auth
- revocation_uri: https://www.makeitla.st/oauth/revoke
- identity type: anonymous
- credential type: none

POST https://www.makeitla.st/agent/auth with `{"type":"anonymous"}` if a client requires a registration call. The response restates public catalog URLs. It does not create an account or issue a token.

If a maker asks you to list a product, send them to /get-listed. Drafting and saving a listing requires their signed-in browser session at /submit. Do not invent or POST a listing on their behalf.

## Maker session APIs

`/api/fill`, `/api/upload`, `/api/verify-badge`, and `/api/payments/status` use the same cookie session as /login. They are not agent OAuth resources.

## Revocation

Public catalog reads have nothing to revoke. `POST https://www.makeitla.st/oauth/revoke` exists for OAuth clients and returns that no catalog token was issued. A human can sign out at /login or delete their account from /account.