# Computer Pro Network auth.md

## Agent registration for public information

Anonymous agents can register to obtain OAuth client credentials restricted to `public.read`. The credential grants access to the optional `/api/agent/` information endpoints only. The normal website, `/api/public/`, MCP and A2A remain available without registration.

This is OAuth dynamic client registration (RFC 7591) followed by the client credentials grant (RFC 6749). It creates an anonymous agent client, not a customer account. It does not claim or authenticate a human identity.

## Discover the service

- Protected Resource Metadata: https://www.computerpronetwork.com/.well-known/oauth-protected-resource
- Authorization Server Metadata: https://www.computerpronetwork.com/.well-known/oauth-authorization-server
- Public signing keys: https://www.computerpronetwork.com/agent/oauth/jwks
- API documentation: https://www.computerpronetwork.com/agent-api.md

## Register anonymously

Send `POST https://www.computerpronetwork.com/agent/register` with `Content-Type: application/json`:

```json
{"client_name":"My public information agent","grant_types":["client_credentials"],"scope":"public.read","token_endpoint_auth_method":"client_secret_basic"}
```

The response is HTTP 201 with `client_id`, `client_secret`, issue and expiry times, `grant_types`, `scope` and the token authentication method. Save the client secret securely: it is returned once and only a keyed hash is stored. Anonymous registration requires no email, customer details, login or payment. Client credentials expire after 30 days. Registration is limited to 6 requests per hour per source and capacity is bounded.

## Obtain an access token

Send `POST https://www.computerpronetwork.com/agent/oauth/token` with `Content-Type: application/x-www-form-urlencoded` and HTTP Basic authentication using the issued client ID and secret:

```text
grant_type=client_credentials&scope=public.read
```

`client_secret_post` is also supported: send the client ID and secret in the HTTPS POST form body when using that registered method. Never put credentials in URLs. Successful responses include `access_token`, `token_type: Bearer`, `expires_in: 900` and `scope: public.read`. Tokens expire after 15 minutes; request a new token using the same unexpired client credentials. There is no refresh token, browser authorization-code flow, customer sign-in or OIDC identity service.

## Use the credential

Send `Authorization: Bearer ACCESS_TOKEN` on GET or HEAD requests to:

- `/api/agent/facts`
- `/api/agent/pricing`
- `/api/agent/services`
- `/api/agent/service-areas`
- `/api/agent/search?query=TOPIC&limit=5`
- `/api/agent/page?path=CANONICAL_PUBLIC_PATH`
- `/api/agent/signed-status`

Only `public.read` is supported. No client can gain private, customer, payment, booking, computer-control or device-result access. Source pages remain the source of truth. The signed-status operation makes one fixed, signed HTTPS request to CPN's public status endpoint; it cannot fetch caller-selected URLs.

## Revoke access

To revoke an access token, send `POST /agent/oauth/revoke` with client HTTP Basic authentication and form body `token=ACCESS_TOKEN`. RFC 7009 returns HTTP 200 for unknown tokens without revealing whether they exist.

To revoke the agent client and all its tokens, send `POST /agent/registration` with client HTTP Basic authentication and form body `action=revoke`. Register a new client if access is needed again. Revoked or expired credentials receive HTTP 401.

## Errors and operational limits

Missing, expired, altered or revoked bearer tokens receive HTTP 401 with a `WWW-Authenticate` discovery hint. Unsupported scopes and registration metadata are rejected. Request bodies are limited to 8192 bytes. Token requests are rate-limited; honor HTTP 429 and Retry-After. The application stores anonymous client IDs, hashed secrets, expiry/revocation information and hashed rate-limit identifiers outside the public website. It stores no customer data or device reports. Normal web-server access logs may record URLs; do not include personal information in queries.

## Pricing, policy and contact

Agent information access is free. Service prices and availability require confirmation with CPN. Read https://www.computerpronetwork.com/prices.html and https://www.computerpronetwork.com/policy.html. Contact Computer Pro Network at 817-658-0707 or https://www.computerpronetwork.com/contact.html.