# MARVO auth.md

Agents reading public MARVO pages do not need an account or an access token.

## Audience

Automated agents fetching `https://marvo.games/` and the public documents linked from it.

## Registration

This site is static. It does not create accounts, send email, or issue credentials.

- Method: anonymous, no credential
- Registration URL: https://marvo.games/agent/register
- Claim URL: https://marvo.games/agent/claim
- Token URL: https://marvo.games/agent/token
- Human contact: hello@marvo.games

`GET` those URLs for the same instructions. Do not `POST` them; nothing is provisioned.

## How to authenticate

Do not send an `Authorization` header. Public HTML, markdown, the API catalog, and the capability manifest are world-readable.

## Discovery

- Protected resource metadata: https://marvo.games/.well-known/oauth-protected-resource
- Authorization server metadata: https://marvo.games/.well-known/oauth-authorization-server
- OpenID configuration: https://marvo.games/.well-known/openid-configuration

The issuer in both authorization-server documents is `https://marvo.games`. That issuer does not sign tokens. `jwks_uri` publishes an empty key set on purpose.