# auth.md — SAINT Technology Services

You are an agent. This document describes how to interact with **SAINT Technology Services** (`https://saintsecured.com`) public APIs and lead endpoints.

SAINT is a veteran-owned managed IT / cybersecurity / physical-security provider (Hickman, NE; Lincoln and Omaha markets). This site is a **marketing and lead-capture surface**, not an OAuth authorization server. There is **no automated agent self-registration** and no `POST /agent/auth` endpoint.

Not an agent? See [clientcare@saintsecured.com](mailto:clientcare@saintsecured.com) or call **531-625-2111**.

## Audience

- AI agents that need to submit **contact**, **estimate**, or **event-lead** data on behalf of a user who has consented.
- Agents that want to read **public threat intelligence** or use the **L1 support assistant** within published rate limits.
- Integrators building on SAINT’s documented Supabase Edge Functions (see API catalog below).

SAINT does **not** issue OAuth access tokens, API keys for partners, or machine credentials through this domain. Partner / MSP integrations are provisioned by humans after a business relationship is established.

## Discovery

| Document | URL | Purpose |
|----------|-----|---------|
| Agent skills index (v0.2.0) | `https://saintsecured.com/.well-known/agent-skills/index.json` | Machine-readable SKILL.md catalog with SHA-256 digests |
| A2A Agent Card | `https://saintsecured.com/.well-known/agent-card.json` | Machine-readable manifest for the L1 support-agent (skills, interface URL, auth) |
| MCP Server Card (SEP-1649) | `https://saintsecured.com/.well-known/mcp/server-card.json` | Pre-connection MCP discovery: transport (`/mcp`), tools, resources, capabilities |
| Agent Skills index | `https://saintsecured.com/.well-known/agent-skills/index.json` | Published SKILL.md artifacts for threat-feed, support-agent, submit-event-lead, auth |
| API catalog (RFC 9727) | `https://saintsecured.com/.well-known/api-catalog` | Machine-readable list of public APIs, OpenAPI specs, and HTML docs |
| OAuth Protected Resource Metadata (RFC 9728) | `https://saintsecured.com/.well-known/oauth-protected-resource` | Resource identifier, authorization server (Supabase Auth), supported scopes |
| Web Bot Auth key directory | `https://saintsecured.com/.well-known/http-message-signatures-directory` | Ed25519 JWKS for verifying SAINT-operated bot HTTP message signatures |
| OIDC discovery (mirror) | `https://saintsecured.com/.well-known/openid-configuration` | Supabase Auth OIDC metadata; `issuer` is the Supabase project URL |
| OAuth AS metadata (RFC 8414, mirror) | `https://saintsecured.com/.well-known/oauth-authorization-server` | Same authorization server in RFC 8414 form |
| OpenAPI specs | `https://saintsecured.com/openapi/*.yaml` | Request/response schemas per endpoint |
| HTML API docs | `https://saintsecured.com/api-docs/*.html` | Human-readable endpoint reference |
| LLM site brief | `https://saintsecured.com/llms.txt` | Routes, contact, positioning |
| This file | `https://saintsecured.com/auth.md` | Agent auth and provisioning policy |

**OAuth authorization server:** SAINT does **not** operate an OAuth/OIDC issuer on `saintsecured.com`. Tokens for public Edge Functions use the **Supabase anon key**, not end-user OAuth access tokens. OIDC/OAuth metadata on this domain mirrors **Supabase Auth** at `https://zzquuspwxqwducijadzl.supabase.co/auth/v1` (`issuer` in discovery JSON is that URL, not `saintsecured.com`). Canonical OIDC discovery also lives at `https://zzquuspwxqwducijadzl.supabase.co/auth/v1/.well-known/openid-configuration`. RFC 9728 PRM on this domain points clients to that issuer.

**Resource identifier (`resource` in PRM):** `https://saintsecured.com/` — this site publishes the API catalog and PRM. Live API endpoints are hosted at `https://zzquuspwxqwducijadzl.supabase.co/functions/v1` (anchors in the API catalog). `WWW-Authenticate` with `resource_metadata` on `401` is not implemented on this static site; future work may add it on Supabase Edge Functions.

## Registration and provisioning

There is **no public agent registration API**. Supported path for new integrations:

1. **Human contact** — email [clientcare@saintsecured.com](mailto:clientcare@saintsecured.com) or [sales@saintsecured.com](mailto:sales@saintsecured.com), or call **531-625-2111**.
2. **Describe the use case** — which endpoints, expected volume, and whether the agent acts for end users who have given consent.
3. **SAINT reviews** — commercial MSP agreements, data handling, and abuse risk are evaluated before any non-public credentials or elevated access.

Do **not** scrape or replay browser session tokens. Do **not** request service-role or admin keys.

## Web Bot Auth (HTTP Message Signatures)

SAINT publishes an Ed25519 **JSON Web Key Set** at `/.well-known/http-message-signatures-directory` (`Content-Type: application/http-message-signatures-directory+json`). The directory response is self-signed when the production private key is configured.

**Key id (JWK thumbprint):** `LsuBUxwRVp-tUfGuQW0SNC6mDoRibjG_hPjBwvj7N9s`

When SAINT-operated agents make outbound HTTP requests to third parties, they attach:

| Header | Purpose |
|--------|---------|
| `Signature-Agent` | Points to this key directory (`"https://saintsecured.com/.well-known/http-message-signatures-directory"`) |
| `Signature-Input` | Signature parameters (`tag=web-bot-auth`, `keyid`, `created`, `expires`, signed components) |
| `Signature` | Ed25519 signature over `@authority` and `signature-agent` |

Browser-initiated calls to the public `support-agent` Edge Function (anon key, end-user session) are **not** Web Bot Auth signed — they are user-context API calls, not SAINT crawler traffic.

**Key rotation (operators):** run `node scripts/generate-web-bot-auth-keys.mjs`, update the public JWK in `functions/lib/web-bot-auth-config.js`, set Cloudflare Pages secret `WEB_BOT_AUTH_PRIVATE_JWK`, redeploy. Never commit the private JWK.

## Supported methods

| Method | Available on saintsecured.com? | Notes |
|--------|-------------------------------|-------|
| `web_bot_auth` (HTTP Message Signatures) | **Yes** | JWKS directory published; outbound signing for SAINT-operated agents |
| `identity_assertion` (agent verified / ID-JAG) | **No** | No trusted agent-provider registration |
| `service_auth` (email + claim ceremony) | **No** | No claim endpoints |
| `anonymous` (pre-claim registration) | **No** | No `POST /agent/auth` |
| **Public browser APIs** (Supabase anon key) | **Yes** | Same surface the website uses; see Credential use |
| **Unauthenticated read** (`threat-feed`) | **Yes** | Public marketing data |
| **Human provisioning** | **Yes** | Email / phone for partner access |

## Public API endpoints

Base host for Edge Functions: `https://zzquuspwxqwducijadzl.supabase.co/functions/v1`

| Endpoint | Methods | Auth | Purpose |
|----------|---------|------|---------|
| `/submit-contact` | `POST` | Supabase **anon** key (`apikey` + `Authorization: Bearer`) | Contact / protection-request leads |
| `/submit-estimate` | `POST` | Supabase anon key | Product estimate requests |
| `/submit-event-lead` | `POST` | Supabase anon key | Funnel / event / tool leads |
| `/support-agent` | `POST` | Supabase anon key + `visitor_id` (UUID) | L1 assistant chat (daily caps) |
| `/threat-feed` | `GET` | **None** | CISA KEV + advisory RSS aggregator |

Full catalog: `https://saintsecured.com/.well-known/api-catalog`

## Credential use

### Supabase anon key (browser-embedded)

The production website embeds a **Supabase project anon key** in client JavaScript (`NEXT_PUBLIC_SUPABASE_ANON_KEY`). This key is intentionally public and is scoped by Supabase Row Level Security and Edge Function logic. Agents may use the same key **only** to call the documented public endpoints above, with the same constraints as the website:

- Send `apikey: <anon-key>` and `Authorization: Bearer <anon-key>`.
- Send `Content-Type: application/json` on `POST` bodies.
- Include required fields per OpenAPI (email, names, line items, etc.).
- Respect **rate limits** and **abuse policies** — automated bulk submission without user consent is prohibited.

The anon key is distributed via the built site bundle, not via this document. Extract it from the deployed site’s JavaScript or request integration guidance from SAINT.

### No bearer token for anonymous leads

Contact, estimate, and event-lead submissions do **not** use a separate user bearer token. Authorization is the anon key plus validated JSON fields. End-user consent is implied by form submission (the site records `consent_given` / `consent` where applicable).

### support-agent

- Requires a stable `visitor_id` (UUID v4) per browser session.
- Daily caps: **10 messages per visitor**, **12 per IP** (server-enforced).
- Actions: `chat` (default) and `capture` (email handoff when cap reached).
- No OAuth; no persistent agent credentials.

### threat-feed

- `GET` only; no API key.
- Optional `?refresh=1` bypasses in-memory cache.
- Returns public CISA-derived data for the marketing site.

## Errors

| HTTP | Meaning |
|------|---------|
| `400` | Invalid JSON or missing required fields |
| `405` | Wrong HTTP method |
| `429` | support-agent quota exceeded |
| `500` | Server misconfiguration or upstream failure |
| `502` | threat-feed upstream sources failed |

## Revocation

There are no agent-issued credentials to revoke on this domain. To stop using public APIs, cease requests. For partner credentials issued out-of-band, contact [clientcare@saintsecured.com](mailto:clientcare@saintsecured.com).

## Policies

- [Privacy](https://saintsecured.com/privacy)
- [Terms](https://saintsecured.com/terms)
- [Contact](https://saintsecured.com/contact)

Integration questions: [clientcare@saintsecured.com](mailto:clientcare@saintsecured.com) · **531-625-2111**