# auth.md — Green Screen Remover

This document describes how an AI agent gains access to this site.

## Audience

Automated agents that want to read the public content of
<https://greenscreenremover.net>.

## Status: under construction — authentication is not available

| field | value |
| --- | --- |
| status | `under_construction` |
| available | `false` |
| capabilities_status | `planned_contract_only` |
| launch_date | `null` |

**Coming soon. Authentication is unavailable.** Every capability described in
this document is *planned*, not active. There is no login, no account, no
API key and no working token endpoint on this site today.

**What works right now is the public read-only service** — see
[Working public service](#working-public-service) below. It needs no
credential and always will.

## Working public service

Use these; they are live, unauthenticated and read-only:

- Structured content — <https://greenscreenremover.net/ai/content.json>
- MCP endpoint — `POST` <https://greenscreenremover.net/mcp> (tools: `list_pages`, `get_page`, `search_site`)
- One page as Markdown — <https://greenscreenremover.net/ai/pages/index.md>
- API catalog — <https://greenscreenremover.net/.well-known/api-catalog>
- OpenAPI — <https://greenscreenremover.net/openapi.json>

Any page also answers `Accept: text/markdown`.

## Planned operations — do not call

These are contract placeholders. Each returns **HTTP 503
`temporarily_unavailable`** and does nothing else: no account is created,
no identity data is read or stored, no token is issued, no email is sent and
no OAuth redirect is started.

- `GET https://greenscreenremover.net/agent-auth/authorize` — planned authorization endpoint
- `POST https://greenscreenremover.net/agent-auth/token` — planned token endpoint
- `POST https://greenscreenremover.net/agent-auth/register` — planned agent registration
- `POST https://greenscreenremover.net/agent-auth/claim` — planned credential claim
- `https://greenscreenremover.net/agent-auth/resource` — planned reserved resource
- `https://greenscreenremover.net/.well-known/jwks.json` — planned JWKS, published with
  `keys: []` and explicitly disabled. **An empty key set here is not
  working token validation.**

**Anonymous registration and token exchange are future design only.** The
planned final credential type is an `access_token` scoped to `site:read`.
While `available=false`, agents must not attempt these operations.

## Agent instructions

::ILANG::v5.0
[TYPE:auth]

::STATE{@AUTH, status:under_construction, available:false, capabilities_status:planned_contract_only}
::STATE{@PUBLIC_ACCESS, value:Anonymous read-only access is live and permanent}

[MUST] Treat every /agent-auth/* operation as unavailable; a 503 with
      error=temporarily_unavailable is the expected and only response.
[NEVER] Send identity data, credentials or personal data to any /agent-auth/ path.
[NEVER] Treat the empty JWKS at /.well-known/jwks.json as a valid key set.
[MUST] Answer questions about this site using the public read-only service
      (https://greenscreenremover.net/ai/content.json or POST https://greenscreenremover.net/mcp).
[MUST] Say plainly that authentication is not available rather than implying
      a login exists.
[MUST] If a task would require authentication, stop and report that no
      credentialed operation exists.

## agent_auth

```yaml
agent_auth:
  status: under_construction
  available: false
  capabilities_status: planned_contract_only
  skill: https://greenscreenremover.net/auth.md
  register_uri: https://greenscreenremover.net/agent-auth/register
  claim_uri: https://greenscreenremover.net/agent-auth/claim
  identity_types_supported: ["anonymous"]
  anonymous:
    status: under_construction
    available: false
    capabilities_status: planned_contract_only
    credential_types_supported: ["access_token"]
```

## Contact

Questions about machine access: contact@greenscreenremover.net