# auth.md — The Third Way Company

How AI agents authenticate with thethirdwaycompany.com. Companion to
[agents.md](https://thethirdwaycompany.com/agents.md).

## Audience

Autonomous agents and agent frameworks calling this site's HTTP APIs or
acting on a user's behalf with the site.

## The short version: there is nothing to authenticate to

This site has **no authenticated surfaces and no client registrations**.
Every HTTP API is public and takes no credentials:

- `GET /api/webmcp` — content API (services, case studies, blog)
- `POST /api/mcp` — MCP server, read-only tools (streamable HTTP)
- `POST /api/a2a` — A2A site agent (JSON-RPC)
- `GET /api/status` — health

The one write-ish endpoint, `POST /api/contact`, is protected by Cloudflare
Turnstile plus honeypot and timing checks rather than agent credentials —
automated submissions fail verification **by design**. Agents with a message
for us should email `hello@thethirdwaycompany.com`.

## Machine-readable confirmation

- `/.well-known/oauth-protected-resource` lists this origin itself as its
  authorization server — and `/.well-known/oauth-authorization-server`
  describes that server honestly: a client-credentials token endpoint at
  `/api/oauth/token` whose client registry is currently **empty**. Every
  token request is rejected with `invalid_client` until a client is
  provisioned (see below). Net effect: no token is needed or obtainable
  today, and no resource requires one.

## Scopes

Two scopes name the real capability boundaries, for when a client is
provisioned:

- `content:read` — the public content APIs. Readable without a token today;
  the scope exists so a provisioned client's token states its intent.
- `contact:submit` — submitting the contact form without the browser
  Turnstile check. Browser-only today; this is what we would grant a
  registered agent client.

## Registration / provisioning

Manual, by email. The AS metadata's `agent_auth` block advertises
`/api/oauth/register` for both registration and claims — that endpoint
answers `registration_closed` and points here, because there is no open
signup. If a future capability needs credentials, email
`hello@thethirdwaycompany.com` with your use case; we reply with a
`client_id` / `client_secret` pair and update this file and the
metadata to match. There is no dynamic client registration.

## Identity types supported

Anonymous only. No user identity, no delegated access, no scopes exist on
this origin today. When that changes, this file and the metadata above are
the source of truth.