# CirclesIRL — Agent Authentication

CirclesIRL matches people into small circles (4–8 people) attending the same
real-world event. Public content (marketing pages, blog, city guides, RSS,
sitemap) needs no authentication. Everything member-facing — circles, chats,
profiles, recaps — requires a signed-in human account.

## Discovery

| Resource | URL |
| --- | --- |
| Protected resource metadata | https://circlesirl.com/.well-known/oauth-protected-resource |
| Authorization server metadata | https://circlesirl.com/.well-known/oauth-authorization-server |
| OpenID Connect discovery | https://circlesirl.com/.well-known/openid-configuration |
| API catalog | https://circlesirl.com/.well-known/api-catalog |
| Agent skills index | https://circlesirl.com/.well-known/agent-skills/index.json |
| Agent documentation | https://circlesirl.com/llms.txt |

## Identity model

Agents act **on behalf of a human member** — there are no autonomous agent
accounts. Every request must carry an access token issued for a real user
after that user signed in and consented.

- Identity type: `human_delegated`
- Credential type: OAuth 2.1 authorization code + PKCE, presented as a
  `Bearer` JWT in the `Authorization` header
- Token issuer: `https://pikjcmzagdeyzmaqeugc.supabase.co/auth/v1`

## Registration

1. Register a client at the `register_uri` published in
   `/.well-known/oauth-authorization-server` (dynamic client registration),
   or contact us to register manually.
2. Send the user through the authorization endpoint with PKCE. The user signs
   in with email/password or Google and approves access.
3. Exchange the code at the token endpoint for an access token and refresh
   token.
4. Call APIs with `Authorization: Bearer <access_token>`. Tokens are scoped to
   that user; row-level security enforces what they can read and write.

## Revocation and support

- A member can revoke agent access at any time by signing out of all sessions
  in **Settings** or deleting their account.
- Refresh tokens can be revoked at the token endpoint with
  `grant_type=refresh_token` logout.
- Questions, abuse reports, or manual client registration:
  info@michellehummel.ceo

## Usage expectations

- Do not create accounts on a human's behalf without their explicit request.
- Do not scrape or store other members' personal data. Profile visibility is
  progressive by design (photos and names unlock in stages) — respect it.
- AI training on CirclesIRL content is not permitted; see
  https://circlesirl.com/robots.txt (`Content-Signal: ai-train=no`).