# Auth.md — Gemmari agent authentication

Gemmari currently exposes public discovery resources and public APIs.

No OAuth 2.0 or OpenID Connect authentication is currently required for the
documented public resources. Gemmari does not currently expose an OAuth
authorization server, an agent registration endpoint, or protected-resource
metadata.

## Agent registration

Agent registration is not currently supported by Gemmari.

- `register_uri`: not available
- `identity_types_supported`: none
- `credential_types_supported`: none
- Claim, authorization, token, and revocation endpoints: not available

The public resources below do not require an agent registration or credentials.

Agents can use these public discovery resources:

- [LLMs index](https://www.gemmari.com/llms.txt)
- [AI catalog](https://www.gemmari.com/.well-known/ai-catalog.json)
- [API catalog](https://www.gemmari.com/.well-known/api-catalog)
- [Agent Skills index](https://www.gemmari.com/.well-known/agent-skills/index.json)
- [Coffee recommendation API description](https://www.gemmari.com/.well-known/openapi/recommend-coffee.json)

If Gemmari introduces protected agent APIs in the future, this document will
be updated with the OAuth/OIDC issuer, registration instructions, scopes, and
token requirements.