# auth.md

You are an agent. **Jardineros en Vigo** supports **agentic registration** for AI agents that need authenticated access to Traking LLMs analytics and MCP abilities.

This document is self-contained: the site does **not** publish OAuth Authorization Server metadata. Follow the registration method below.

## Audience
AI agents, MCP clients, and automated tools acting on behalf of a site operator.

## Agent registration
Agents register (provision credentials) using **WordPress Application Passwords**.

- **Registration / provisioning endpoint (human UI):** https://jardinerosenvigo.com/wp-admin/profile.php#application-passwords-section
- **register_uri:** https://jardinerosenvigo.com/wp-admin/profile.php#application-passwords-section
- **Supported method:** `application_password` (WordPress Application Passwords)
- **Supported identity types:** site user with Application Passwords enabled
- **Credential type:** username + application password (HTTP Basic)

### How to register
1. A site administrator opens the provisioning endpoint and creates an Application Password for agent use.
2. The agent stores `{username}` and `{application_password}`.
3. The agent authenticates to protected APIs with HTTP Basic or the adapter transport.

## Credential use
- Send `Authorization: Basic base64(username:application_password)` to WordPress REST and MCP Adapter endpoints that require auth.
- Analytics REST base: `https://jardinerosenvigo.com/wp-json/traking-llms/v1`
- Optional plugin REST key header when configured: `X-TLM-Key`
- Administrators may also use cookie auth with `manage_options` in trusted browser sessions.

## What is not provided
- No `/.well-known/openid-configuration`
- No `/.well-known/oauth-authorization-server`
- No `/.well-known/oauth-protected-resource` with invented `authorization_servers`
- No automated `POST /agent/auth` registration API (passive discovery only)

## Discovery links
- skill (this file): https://jardinerosenvigo.com/auth.md
- MCP manifest: https://jardinerosenvigo.com/.well-known/mcp.json
- MCP server card: https://jardinerosenvigo.com/.well-known/mcp/server-card.json
- API catalog: https://jardinerosenvigo.com/.well-known/api-catalog
- Agent skills index: https://jardinerosenvigo.com/.well-known/agent-skills/index.json
- llms.txt: https://jardinerosenvigo.com/llms.txt

## MCP Adapter
WordPress MCP Adapter is available. After agent registration via Application Passwords, use the adapter transport with those credentials ([wordpress/mcp-adapter](https://github.com/WordPress/mcp-adapter)).