# CariTalent auth.md

Audience: automated agents that need scoped public-directory context. Public search, profiles, MCP and A2A do not require registration. Never register during passive discovery.

## Anonymous provisioning

POST https://caritalent.com/oauth/register with Content-Type: application/json and body {"client_name":"Your agent name","grant_types":["client_credentials"]}.

This creates a client_id and client_secret, shown once, valid for 30 days. Identity type: anonymous. Credential type: client_secret. Provisioning endpoint: https://caritalent.com/oauth/register. No verified email or ID-JAG method is offered. No email is sent.

## Optional ownership claim

claim_uri: https://caritalent.com/oauth/claim. A human who controls the client opens this page, signs in, and submits the client_id and client_secret plus explicit ownership consent. Credentials belong only in the protected POST form, never in URLs. Ownership cannot be transferred by another account. Claiming records ownership only: directory:read remains the sole scope. It does not reveal the human account to the agent, assert a verified agent identity, or add private access. Anonymous use does not require claiming.

## Credential use

POST https://caritalent.com/oauth/token with application/x-www-form-urlencoded fields grant_type=client_credentials, client_id, client_secret, scope=directory:read (optional resource=https://caritalent.com). Store credentials securely and never place them in URLs. Send the returned 15-minute token only as Authorization: Bearer to https://caritalent.com/api/agent/context.

Optional authorization_code clients register exact HTTPS redirect_uris, use /oauth/authorize with response_type=code and S256 PKCE, sign in and consent, then exchange the single-use two-minute code with the original redirect_uri and code_verifier plus client credentials. No refresh token, OIDC ID token, verified identity or private data scope is provided.

## Revoke and remove

POST /oauth/revoke with client_id, client_secret and token to revoke a token. POST /oauth/unregister with client_id and client_secret to revoke the client and all tokens. Both use application/x-www-form-urlencoded. No account, administration or contract permissions are granted.

## Discovery and limits

- [Authorization server](https://caritalent.com/.well-known/oauth-authorization-server)
- [Protected resource](https://caritalent.com/.well-known/oauth-protected-resource)
- [API documentation](https://caritalent.com/docs/api)
- [Registration skill](https://caritalent.com/.well-known/agent-skills/agent-registration/SKILL.md)

Registration: 5 per IP per hour and 50 per day globally. OAuth requests: 30 per IP per minute. Respect 429 responses. Ask the operator before provisioning credentials; passive scans should read this document only.