# auth.md — Calligraphy Generator

Calligraphy Generator welcomes browser agents and API agents that help users create, save, and export calligraphy designs responsibly.

## Agent audience

Agents may use public pages without registration for discovery, reading, and user-assisted navigation. Protected Studio APIs require a user-authorized bearer token.

## Discovery endpoints

- OAuth Protected Resource Metadata: https://www.calligraphy-generator.com/.well-known/oauth-protected-resource
- OAuth Authorization Server Metadata: https://www.calligraphy-generator.com/.well-known/oauth-authorization-server
- OpenID Configuration: https://www.calligraphy-generator.com/.well-known/openid-configuration
- API Catalog: https://www.calligraphy-generator.com/.well-known/api-catalog
- OpenAPI Description: https://www.calligraphy-generator.com/.well-known/openapi.json

## Verified email registration

Users sign in through the website's Studio authentication flow. Agents acting for a user should direct the user to https://www.calligraphy-generator.com/login or https://www.calligraphy-generator.com/studio and use only user-approved tokens issued by the configured authorization server.

- Issuer: https://www.calligraphy-generator.com
- Registration endpoint: https://www.calligraphy-generator.com/auth.md
- Authorization server metadata: https://www.calligraphy-generator.com/.well-known/oauth-authorization-server
- Credential type: OAuth 2.0 authorization-code with PKCE / Supabase user access token
- Bearer method: Authorization header
- Protected scopes: openid, email, profile, studio:read, studio:write, exports:write

## Anonymous agent access

Anonymous agents can read public HTML and markdown-negotiated pages, API discovery documents, robots.txt, the skills index, sitemap.xml, and public blog/generator content. Anonymous agents cannot write Studio export records.

## Credential use

Send protected API credentials as:

```http
Authorization: Bearer <access_token>
```

Do not scrape or infer private Studio data. Do not use generated Arabic, Chinese, sacred, tattoo, legal-signature, or permanent-use artwork as final authority without qualified human review.