# auth.md

Agent registration and credentials for https://sign.blacklabeltec.com (BL Sign). Machine-readable companions: https://sign.blacklabeltec.com/.well-known/api-catalog, https://sign.blacklabeltec.com/openapi.json, https://sign.blacklabeltec.com/.well-known/mcp/server-card.json.

## Agent audience

Automated agents, crawlers and MCP clients that read BL Sign's public pages or call the agent endpoints on this host: `/agent/site.json`, `/agent/search`, `/agent/read` and the MCP endpoint `POST /mcp`.

## Registration and provisioning endpoints

- Registration endpoint: none. Agents do not register with this host and nothing here creates agent accounts.
- Provisioning endpoint: none for agents. The public site tools described here are open. Other product endpoints may require authentication.
- OAuth Authorization Server metadata and Protected Resource Metadata are intentionally not published: no authorization server exists for these endpoints, so publishing one would be false.

## Supported methods

| Method | Supported | Notes |
|---|---|---|
| anonymous | yes | public site tools only; rate limited per client |
| identity assertion (ID-JAG) | no | no authorization server |
| verified email | no | not required for read access |
| Web Bot Auth signed requests (RFC 9421) | accepted, optional | send `Signature-Agent`, `Signature-Input` and `Signature`; this site's own bot key directory is https://sign.blacklabeltec.com/.well-known/http-message-signatures-directory |

## Credential use

No credential is required or issued for `/agent/site.json`, `/agent/search`, `/agent/read`, `/mcp`, `/openapi.json`, `/llms.txt` and the pages in the sitemap. Send a descriptive `User-Agent` and stay under one request per second; over-limit clients receive HTTP 429.

## Contact and removal

https://sign.blacklabeltec.com/