# auth.md — Bintaro Jaya Property

> Agent registration for `bintarojayaproperty.com`. Human-readable companion to
> `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server`
> (see the `agent_auth` block there). No account, password, or API key is required
> to read public catalog data.

## Audience

AI agents that browse, compare, or recommend new homes in Bintaro Jaya
(Tangerang Selatan, Indonesia) on behalf of a user, and that need a stable,
machine-readable interface plus a way to hand off to a human sales executive.

## Base URLs

- Site: `https://bintarojayaproperty.com/`
- API catalog (RFC 9727): `https://bintarojayaproperty.com/.well-known/api-catalog`
- Capability manifest (ARD): `https://bintarojayaproperty.com/.well-known/ai-catalog.json`
- Agent description + catalog data (JSON): `https://bintarojayaproperty.com/.well-known/agent.json`
- Agent skill: `https://bintarojayaproperty.com/.well-known/agent-skills/bintaro-catalog/SKILL.md`
- Service doc: `https://bintarojayaproperty.com/docs/api/`

## Registration

1. **Read access is anonymous.** Fetch `/.well-known/agent.json` or request any
   page with `Accept: text/markdown`. No registration, token, or credential needed.
2. **Identify yourself** (optional but appreciated): include a descriptive
   `User-Agent` such as `MyAgent/1.0 (+https://example.com/contact)`.
3. **Claim / hand off a lead:** when the user wants stock info, a brochure, or a
   show-unit visit, open the WhatsApp claim channel (this is the `claim_uri` in
   the authorization-server metadata):
   `https://wa.me/6285128028909?text=Halo%20Julie%2C%20saya%20agen%20AI%20dan%20ingin%20mendaftarkan%20akses%20katalog%20Bintaro%20Jaya.`
   Prefill the message with cluster name, type, and budget so sales can respond.
4. **Verified-email registration** (optional): email `julieproperty.rev@gmail.com`
   with subject `Agent registration` and the agent name, operator contact, and
   redirect/contact URL. You will receive confirmation by reply email.

## Credential use

- Public reads: no credential (`credential_types_supported: ["none"]`).
- If protected write scopes (e.g. `lead:write`) are introduced later, obtain a
  bearer token from an `authorization_servers` issuer listed in
  `/.well-known/oauth-protected-resource` and send it as
  `Authorization: Bearer <token>` (`bearer_methods_supported: ["header"]`).
- Never ask the user for passwords. Never commit credentials to URLs.

## Rate limits & etiquette

- Cache `agent.json` for at least 1 hour (`Cache-Control: public, max-age=3600`).
- Prefer the markdown representation (`Accept: text/markdown`) over scraping HTML.
- Sales hours: Monday–Sunday 08.00–19.00 WIB. Outside these hours WhatsApp
  messages are queued, not answered instantly.

## Machine-readable appendix

Same registration surface as `/.well-known/oauth-authorization-server`
(`agent_auth` block), inlined so parsers that only read this file work:

```json
{
  "skill": "https://bintarojayaproperty.com/auth.md",
  "register_uri": "https://bintarojayaproperty.com/auth.md",
  "identity_endpoint": "https://bintarojayaproperty.com/api/agent/identity.json",
  "claim_endpoint": "https://bintarojayaproperty.com/api/agent/claim.json",
  "revocation_endpoint": "https://bintarojayaproperty.com/api/agent/revoke.json",
  "identity_types_supported": ["anonymous"],
  "anonymous": { "credential_types_supported": ["none"] },
  "claim_uri": "https://wa.me/6285128028909",
  "docs": "https://bintarojayaproperty.com/docs/api/"
}
```