# auth.md

Agents can read this portfolio without an account. Hacı Samed Yeşil (Samed Yeşil) publishes a public website at `https://samedyesil.com.tr`. There is no user database, no email verification, and no private API.

## Audience

- AI agents fetching public portfolio, contact, and service information
- Humans who want the same pages in a browser

## What you can do without registering

Read these URLs with no `Authorization` header:

- `GET https://samedyesil.com.tr/api/portfolio.json`
- `GET https://samedyesil.com.tr/api/health.json`
- `GET https://samedyesil.com.tr/llms.txt`
- `GET https://samedyesil.com.tr/llms-full.txt`
- `GET https://samedyesil.com.tr/` with `Accept: text/markdown`

## Discovery

1. `GET /.well-known/oauth-protected-resource`
2. `GET /.well-known/oauth-authorization-server` (issuer `https://samedyesil.com.tr`)
3. Read `agent_auth` in that document

Protected resource metadata:

- `resource`: `https://samedyesil.com.tr` (the site origin). A path such as `/api/private` uses `/.well-known/oauth-protected-resource/api/private`, and `resource` there is the full URL of that path.
- `authorization_servers`: `https://samedyesil.com.tr`
- `scopes_supported`: `portfolio.read`
- `bearer_methods_supported`: `header`

## Registration

`POST https://samedyesil.com.tr/oauth/register`

```json
{
  "type": "anonymous",
  "requested_credential_type": "none"
}
```

The response does **not** create an account and does **not** send email. `credential_types_supported` is `none`. The JSON body includes a published bearer token whose value is the word `public`. That value is not a secret. Calling the portfolio API without a token returns the same document.

`identity_types_supported`: `anonymous` only. ID-JAG and verified-email registration are not offered.

## Claim

`POST https://samedyesil.com.tr/oauth/claim` does not start a one-time-code ceremony. There is no account to claim. To reach the person, email `hacisyesil@gmail.com`.

## Using a token

If a client requires a bearer token, send:

```http
Authorization: Bearer public
```

Scope: `portfolio.read`. The token endpoint is `POST /oauth/token` with `grant_type=client_credentials`. The same public token is returned.

## Closed path

`GET /api/private` always responds `401` with `WWW-Authenticate` pointing at the protected-resource metadata. It is a discovery signal. Portfolio content is the public resource above, not this path.

## Türkçe

Bu site herkese açık bir portfolyodur. Hesap açılmaz, e-posta gönderilmez. İçerik için kayıt zorunlu değildir. İletişim: `hacisyesil@gmail.com`.