# Authentication — 0B6OS

_Machine-readable summary of how to authenticate with this site._

## Short version

**Most of what an agent wants needs no authentication at all.** All published
content is publicly readable, and every page can be fetched as Markdown:

```sh
curl -H 'Accept: text/markdown' https://www.0b6os.com/
```

Start at [https://www.0b6os.com/sitemap.xml](https://www.0b6os.com/sitemap.xml), and see the skills
index at
[https://www.0b6os.com/.well-known/agent-skills/index.json](https://www.0b6os.com/.well-known/agent-skills/index.json).

## Agent registration

**Not offered.** This deployment does not issue API keys, client credentials, or
agent identities, and has no registration endpoint. There is no
`/.well-known/oauth-authorization-server` and no
`/.well-known/oauth-protected-resource` here — deliberately, because this site
is an OAuth *client*, not an authorization server. Publishing that metadata
would point you at token endpoints that do not exist.

Do not probe for them. If you need access beyond public content, ask the site
owner (see "Contact" below).

## How human sign-in works

Authenticated areas (the admin console, `/profile`, the CMS and chat APIs) are
protected by an **unsigned opaque session cookie**, established by a human logging
in. The browser holds only the raw opaque token; D1 stores its digest, expiry,
identity, and current roles so sessions can be revoked server-side.

| Property   | Value                                       |
| ---------- | ------------------------------------------- |
| Cookie     | `session`                                   |
| Path       | `/`                                         |
| Flags      | `HttpOnly`, `SameSite=Lax`, `Secure` on HTTPS |
| Lifetime   | 7 days                                      |

Sign-in routes:

- `POST https://www.0b6os.com/api/auth/login` — `{ "email", "password" }`. Returns `200`
  with a `Set-Cookie`, `400` if fields are missing, `401` on bad credentials.
- `POST https://www.0b6os.com/api/auth/signup` — create an account.
- `GET https://www.0b6os.com/api/auth/github`, `GET https://www.0b6os.com/api/auth/discord` — begin an
  OAuth sign-in **with that provider as the identity source**. These are not
  endpoints this site issues tokens from.
- `POST https://www.0b6os.com/api/auth/logout` — clear the session.

Because the cookie is `HttpOnly` and set by a login the user performs, an agent
can only act on authenticated surfaces while operating **inside an already
signed-in browser session** (for example a browser-extension agent, or WebMCP
tools running on the page — see below). There is no headless credential flow.

## Bearer tokens

Not supported. No endpoint on this site accepts an `Authorization: Bearer`
header. Sending one has no effect.

## In-browser tools (WebMCP)

When a user visits this site with a WebMCP-capable agent, the page registers
tools via `navigator.modelContext` for searching, reading, and visible
same-origin navigation. Page reads are restricted to the public sitemap
allowlist and omit browser credentials, so an authenticated browser cannot use
WebMCP to expose private or admin content.

## Rate limits and etiquette

- Crawl rules and content-usage terms: [https://www.0b6os.com/robots.txt](https://www.0b6os.com/robots.txt)
- Prefer `Accept: text/markdown` over scraping HTML; it is cheaper for both of us.
- Prefer `https://www.0b6os.com/sitemap.xml` over crawling link-by-link.

## Contact

Reach the site owner through
[https://www.0b6os.com/contact](https://www.0b6os.com/contact), or programmatically via
`POST https://www.0b6os.com/api/contact-form-submissions` (public; may require a Turnstile
token). See the `send-a-contact-message` skill for the full contract.