# auth.md

## Rise Beer Academy — Agent Authentication & Registration Specification

> **Specification:** WorkOS auth.md v1.0 / Agent Auth RFC  
> **Resource Server:** https://risebeer.com.br/  
> **Issuer / Auth Server:** https://risebeer.com.br  
> **Status:** Open Access / Agent-Ready  

### 1. Audience & Overview
This service grants autonomous AI agents, LLMs, and conversational assistants open, read-write access to explore course curricula, query beer style taxonomy (Raio Cheers), and submit prospect registrations (leads) on behalf of users.

### 2. Supported Identity Types & Flows
- **Anonymous Access (`anonymous`):**
  - **Method:** Open POST requests without pre-shared keys.
  - **Endpoint:** `https://risebeer.com.br/lead-api.php`
  - **Credentials:** None required (`credential_types_supported: ["none", "bearer"]`).
- **Verified Identity / Assertions (`identity_assertion`):**
  - **Supported Tokens:** `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
  - **Claim Endpoint:** `https://risebeer.com.br/lead-api.php`
  - **Credentials:** Bearer token or Header assertion.

### 3. Discovery Metadata Endpoints
- **OAuth Protected Resource Metadata:** `https://risebeer.com.br/.well-known/oauth-protected-resource`
- **OAuth Authorization Server Metadata:** `https://risebeer.com.br/.well-known/oauth-authorization-server`
- **OpenID Configuration:** `https://risebeer.com.br/.well-known/openid-configuration`
- **Agent Resource Discovery (ARD):** `https://risebeer.com.br/.well-known/ai-catalog.json`

### 4. Scopes
- `read`: Query course details, Sommelier curriculum, and MEC accreditation.
- `write`: Submit student applications and lead inquiries.
- `leads`: Register interest for next cohort.

### 5. Technical Contact & Support
- **Organization:** Rise Beer Academy
- **Engineering Email:** `contato@risebeer.com.br`