# auth.md

Agents register here for an advertiser credential. Reading the directory does not require a credential. Booking an advertisement does.

Public reads of organizations, offices, sources, and the rate card stay open. `POST /api/v1/ads/negotiations/{id}/book` and `GET /api/v1/premium/fill-report` require a bearer token.

## Register

`POST https://burbank-industries.pages.dev/api/auth/register`

JSON body: `{"advertiser_name":"Example Stages","contact_email":"ads@example.com"}`

The response includes `client_id` and `client_secret` once. Store the secret. It is not shown again.

## Token

`POST https://burbank-industries.pages.dev/oauth/token`

`grant_type=client_credentials`, with `client_secret_post` or `client_secret_basic`.

Send `Authorization: Bearer` on booking requests. Tokens expire after one hour. Ask for another with the same secret.

Business reports, ad offers, bookings, checkout offers, and advertiser registrations share 10 submissions per week for each IP address.

Budgets at or above the desk threshold still wait for a person after the token is accepted.

```json
{
  "agent_auth": {
    "skill": "auth.md",
    "register_uri": "https://burbank-industries.pages.dev/api/auth/register",
    "methods": [
      {
        "id": "anonymous-advertiser",
        "identity_types_supported": ["anonymous"],
        "anonymous": { "credential_types_supported": ["client_secret"] },
        "claim_uri": "https://burbank-industries.pages.dev/api/auth/register"
      }
    ]
  }
}
```