# auth.md

> Agent registration and credentials for **Claude Workshop** (`https://www.claudeworkshop.com/api`).

This document follows the [Auth.md](https://workos.com/auth-md) discovery pattern. Agents should read `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server` for machine-readable metadata.

## Audience

Autonomous agents, MCP clients, and integration runners that call Claude Workshop JSON APIs on behalf of users or as provisioned automations.

## Discovery

| Document | URL |
| --- | --- |
| Protected Resource Metadata (RFC 9728) | https://www.claudeworkshop.com/.well-known/oauth-protected-resource |
| Authorization Server (RFC 8414) | https://www.claudeworkshop.com/.well-known/oauth-authorization-server |
| OpenID Provider | https://www.claudeworkshop.com/.well-known/openid-configuration |
| API catalog (RFC 9727) | https://www.claudeworkshop.com/.well-known/api-catalog |
| JWKS | https://www.claudeworkshop.com/.well-known/jwks.json |

On `401 Unauthorized`, read `WWW-Authenticate` and follow the `resource_metadata` URL above.

## Registration endpoints

| Method | Endpoint | Purpose |
| --- | --- | --- |
| POST | https://www.claudeworkshop.com/api/agent/auth | Register an agent identity and receive credentials |
| POST | https://www.claudeworkshop.com/api/agent/auth/claim | Start or complete user-claimed binding (OTP / email) |
| POST | https://www.claudeworkshop.com/api/agent/auth/revoke | Revoke agent credentials or identity assertions |

OAuth dynamic client registration (RFC 7591-style): `https://www.claudeworkshop.com/api/oauth/register` (operator-provisioned clients).

## Supported identity types

- **`identity_assertion`**: Present an ID-JAG (`urn:ietf:params:oauth:token-type:id-jag`) or `verified_email` assertion to `https://www.claudeworkshop.com/api/agent/auth`.
- **`anonymous`**: Request a pre-claim API key, then upgrade via `https://www.claudeworkshop.com/api/agent/auth/claim`.

## Supported credential types

| Flow | Credentials |
| --- | --- |
| Identity assertion | `access_token`, `api_key` |
| Anonymous | `api_key` (pre-claim), then scoped upgrade after claim |

## Scopes

| Scope | Access |
| --- | --- |
| `locations:read` | Read workshop location hints |
| `careers:submit` | Submit trainer applications |
| `lead-magnet:submit` | Lead-magnet requests (Claude brand only) |

## Public read (no registration)

HTML, Markdown (`Accept: text/markdown`), `llms.txt`, sitemaps, research pages, and OpenAPI descriptions do not require registration.

## Operator provisioning

Claude Workshop issues production agent clients manually. POST registration endpoints return structured errors until a client is provisioned; do not send live user data until credentials are issued.

## Human escalation

Workshop bookings: https://harness.institute/call