# auth.md - a2a-peptides.ai (A2A Peptides, operated by A2A Peptides Corp.)

## Register an agent

1. POST https://peptides-registry.ai/oauth/register with JSON {"client_name": "<your agent>", "client_uri": "<your site>", "contacts": ["<email>"], "actor_class": "<authorized_trading_partner member | prescriber | agent>", "jurisdiction": "<US | CA | MX | EU-<member> | UK | KR | JP | SG | CH>", "licence": {"type": "…", "number": "…", "issuer": "…"}} - the answer carries client_id and client_secret (shown once).
2. POST https://peptides-registry.ai/oauth/token with grant_type=client_credentials (client_secret_basic or client_secret_post), scope `peptides.read peptides.transact`, optional resource - the answer is a Bearer JWT (ES256, kid a2ap-as-2026-09, 1 hour) that verifies against https://peptides-registry.ai/oauth/jwks.json.
3. Present it as `Authorization: Bearer <token>` on the transacting tools of the door (https://mcp.a2a-peptides.ai/mcp): find_licensed_supplier, get_availability, get_price, get_lot_coa, create_order_intent, a2a_handoff. The actor class in the token is what resolve_actor reads; a licence claim is read by a person before trade information opens (A2AP_10).
4. Revoke at https://peptides-registry.ai/oauth/revoke (RFC 7009). Metadata: https://peptides-registry.ai/.well-known/oauth-authorization-server · this host's protected-resource metadata at https://a2a-peptides.ai/.well-known/oauth-protected-resource.

## Posture

The page, the Markdown twins, llms.txt and every /.well-known/ document on this surface are open: no authentication to read. On the door the reads (substance record, pathway status, cleared catalogue, enforcement watch, safety label) need no token. Registry-truth resolves and order intents settle by x402 (a payment, not a token) at https://a2a-peptides.ai/api.

## Keys

- Issuer keyring: https://peptides-registry.ai/oauth/jwks.json - kid a2ap-as-2026-09 (ES256)
- Hub keyring: https://a2a-peptides.ai/.well-known/jwks.json - kid a2ap-2026-09 (ES256): Agent Cards and signed records
- Receipt keyring: https://peptides-x402.ai/x402/jwks.json - kid a2ap-x402-receipts-2026-09 (EdDSA)

## Settlement

- x402 v2, USDC on Base, after the gate: on an order intent the gate runs before settlement and a deny is not charged. Receipts: order-intent receipts carry decision_id and reason_code; every receipt carries the notice; resolve receipts carry jurisdiction and rule_set_version when the tool takes a jurisdiction. Register: /x402/settled.json per zone with family_settled beside it.

## Contact

- mcp@a2a-peptides.ai (registry contact) - human door https://a2a-peptides.ai/#contact

## Machine block

```json
{
  "agent_auth": {
    "skill": "https://a2a-peptides.ai/auth.md",
    "register_uri": "https://peptides-registry.ai/oauth/register",
    "token_endpoint": "https://peptides-registry.ai/oauth/token",
    "authorization_server": "https://peptides-registry.ai/.well-known/oauth-authorization-server",
    "resource_metadata": "https://a2a-peptides.ai/.well-known/oauth-protected-resource",
    "identity_types_supported": [
      "oauth2_client_credentials"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "client_credentials"
      ],
      "credential_types_supported": [
        "oauth2_client_credentials"
      ]
    },
    "scopes_supported": [
      "peptides.read",
      "peptides.transact"
    ],
    "claim_uri": "https://a2a-peptides.ai/#contact",
    "reads": "open, no token",
    "transacting_tools": [
      "find_licensed_supplier",
      "get_availability",
      "get_price",
      "get_lot_coa",
      "create_order_intent",
      "a2a_handoff"
    ]
  }
}
```