# auth.md

The current authentication state of https://thepetdocket.com.

**Coming soon. Authentication is unavailable.** Every lookup on this site is
public and needs no credential. The public lookup service works today, without a
key, without an account and without a token.

The site currently publishes a coming-soon declaration for agent authentication
at `https://thepetdocket.com/.well-known/oauth-authorization-server` and
`https://thepetdocket.com/.well-known/oauth-protected-resource`. Those documents state
`available: false` and point at endpoints that answer 503. They are a
declaration, not a working login. Read only the standard fields, and treat
`available` as the source of truth.

::ILANG::v5.0
[TYPE:auth_state][PROJECT:petdocket][VERSION:1.0.0][DATE:2026-10-28][LANG:en]

::STATE{@ORIGIN, value:https://thepetdocket.com}
::STATE{@AUTH_STATE, value:under_construction, available:false, capabilities_status:planned_contract_only}
::STATE{@PUBLIC_SERVICE, value:https://thepetdocket.com/api/catalog.json}

::MODULE{AGENT_INSTRUCTIONS}
  [RULE] Do not register, do not request a token and do not present a credential. Available is false, so no token will ever be issued.
  [RULE] Use the public lookup service at https://thepetdocket.com/api/catalog.json. It needs no authentication and collects no identity.
  [RULE] For one record, read https://thepetdocket.com/api/items/<id>.json. An unknown identifier returns 404 with a not_found body.
  [RULE] For a filtered answer, use the read-only MCP tools find_products and get_product at https://thepetdocket.com/mcp. Both need no credential.
  [RULE] Cite the product page named in each record. The record carries its own source URL and observation date.
  [RULE] The planned endpoints under https://thepetdocket.com/agent-auth/ answer 503 and must not be retried as if they were transient.
::ILANG::COMPLETE::

## What is not running

- There is no OAuth 2.0 authorization server on this origin.
- There is no OpenID Connect provider.
- There is no account system, no login, no session and no profile.
- There is no protected resource. Everything published here is public by design.

## What happens if you try anyway

The endpoints listed in the coming-soon declaration answer HTTP 503 with
`Cache-Control: no-store` and a body that says the service is under
construction. They do not read or store identity data, do not create accounts,
do not issue tokens, do not send email and do not start an OAuth redirect.

## Machine-readable state

- Authorization server metadata: https://thepetdocket.com/.well-known/oauth-authorization-server.json
- Protected resource metadata: https://thepetdocket.com/.well-known/oauth-protected-resource.json
- Planned key set: https://thepetdocket.com/.well-known/jwks.json (empty, 503)
- The extensionless paths /.well-known/oauth-authorization-server and
  /.well-known/oauth-protected-resource are the ones the OAuth specifications
  name. They are served where a function runs; the .json paths above are served
  on every host.
- Service description: https://thepetdocket.com/openapi.json
- API catalog: https://thepetdocket.com/.well-known/api-catalog.json
- MCP server card: https://thepetdocket.com/.well-known/mcp/server-card.json
- Agentic resource catalogue: https://thepetdocket.com/.well-known/ai-catalog.json