# auth.md

## Status: no self-serve agent registration today

AlertForge does not yet implement the [auth.md agentic-registration protocol](https://github.com/workos/auth.md) (no `/agent/identity`, `/agent/identity/claim`, or ID-JAG verification endpoints exist, and the `/.well-known/oauth-authorization-server` metadata below deliberately omits an `agent_auth` block). This document is honest about what exists today, and how to reach a human for anything beyond it.

## What exists today

- **Human sign-in only.** AlertForge accounts are created and authenticated through the web app at https://alertforge.ai/signup and https://alertforge.ai/login, via Supabase Auth (email/password, magic link, or Google OAuth sign-in). There is no API-key or client-credentials flow for a third-party agent to provision an AlertForge account on a user's behalf.
- **Token issuer.** Signed-in sessions are JWTs issued by AlertForge's Supabase Auth project. The verified, live discovery documents are:
  - `/.well-known/oauth-protected-resource` -- points at the real token issuer (RFC 9728).
  - `/.well-known/openid-configuration` and `/.well-known/oauth-authorization-server` -- mirror that issuer's own metadata (`issuer`, `jwks_uri`, etc.), verified by direct request against the source on 2026-07-22.
  - **Known gap:** the issuer's `authorization_endpoint` / `token_endpoint` in that mirrored document currently return `feature_disabled` -- Supabase's third-party-facing OAuth-authorization-server feature is switched off for this project. `jwks_uri` is fully live and is the correct way to verify an AlertForge session JWT today.
- **Public, unauthenticated surface.** `GET /api/health` (liveness) and the read-only MCP server at `/api/mcp` (see `/.well-known/mcp/server-card.json`) -- three informational tools (`get_product_info`, `get_pricing`, `get_faq`), no auth, no side effects.
- **Session-authenticated surface.** Everything else (checkout, dashboard, renders) requires a signed-in Supabase session in the browser -- see `/openapi.json` and `/docs/api`.

## If you're building agent/API access

There's no self-serve registration flow yet. Email **support@alertforge.ai** with what you're trying to build -- we're interested in the [auth.md](https://github.com/workos/auth.md) / ID-JAG pattern for a future release and would rather talk through a real integration than publish a half-working one.