# auth.md

## Audience

AI agents and automated clients that want to interact with Anker Shipping’s **public** website resources (quote requests, discovery catalogs, and published documentation).

## Authentication policy

Anker Shipping’s public site and quote form do **not** require a bearer token for normal use.

- Public HTML pages: no credentials
- `POST /contact.php` quote submission: no bearer token; anti-abuse controls (rate limit, honeypot, time trap) apply
- Machine discovery documents under `/.well-known/` are public

OAuth/OIDC **discovery metadata** is published for agent tooling compatibility:

- `/.well-known/openid-configuration`
- `/.well-known/oauth-authorization-server`
- `/.well-known/oauth-protected-resource`
- `/.well-known/jwks.json`

Authorization and token endpoints respond with OAuth error responses explaining that public quote access does not require token issuance. Anonymous agent registration is acknowledged at `/oauth/register.php`.

## Supported methods

| Method | Status | Notes |
|---|---|---|
| Anonymous public access | Supported | Read pages, catalogs, OpenAPI, health |
| Public quote form POST | Supported | See OpenAPI contact API |
| OAuth discovery metadata | Published | For agent discovery scanners / tooling |
| Interactive OAuth login for agents | Not offered | Use public form / WhatsApp |
| API keys | Not offered | — |

## How agents should proceed

1. Discover capabilities via `/.well-known/ai-catalog.json` and `/.well-known/api-catalog`.
2. Use `/.well-known/openapi/contact-api.json` for quote field schemas.
3. Prefer human handoff via WhatsApp `https://wa.me/971552636071` or phone `+97142360808` when a live quote is needed.
4. For skill-style guidance, load `/.well-known/agent-skills/index.json`.

## Contact for integrations

Email: ycc@ankershipping.com  
Company: Anker Shipping Services FZCO — Dubai Airport Free Zone, Block E-22