---
name: auth-md
description: Agent registration and authentication instructions for Io Pictures Corporation (iopictures.com).
---

# Io Pictures auth.md

This document describes how autonomous AI agents discover, register, and authenticate with **Io Pictures** (`https://iopictures.com`).

## Audience & Public Read-Only Access

All public film metadata, Markdown representations, and Model Context Protocol (MCP) tools on `https://iopictures.com` are **publicly readable without authentication**:

- **MCP Server (Streamable HTTP):** `POST https://iopictures.com/mcp`
- **MCP Server Card:** `https://iopictures.com/.well-known/mcp/server-card.json`
- **API Catalog (RFC 9727):** `https://iopictures.com/.well-known/api-catalog`
- **OpenAPI 3.1 Specification:** `https://iopictures.com/openapi.json`
- **LLM Reference:** `https://iopictures.com/llms.txt` and `https://iopictures.com/llms-full.txt`

## OAuth 2.0 / OIDC & Agent Registration Discovery

For agents and platforms that require OAuth 2.0, OpenID Connect, or Auth.md registration discovery:

- **Protected Resource Metadata (RFC 9728):** `https://iopictures.com/.well-known/oauth-protected-resource`
- **Authorization Server Metadata (RFC 8414):** `https://iopictures.com/.well-known/oauth-authorization-server`
- **OpenID Connect Discovery 1.0:** `https://iopictures.com/.well-known/openid-configuration`
- **JSON Web Key Set (JWKS):** `https://iopictures.com/.well-known/jwks.json`
- **Agent Registration Endpoint:** `POST https://iopictures.com/oauth/register`
- **Token Endpoint:** `POST https://iopictures.com/oauth/token`
- **Revocation Endpoint:** `POST https://iopictures.com/oauth/revoke`
- **Claim URI:** `https://iopictures.com/oauth/claim`

## Supported Registration & Identity Flows

1. **Anonymous Agent Registration (`anonymous`):**
   - Supported credential types: `api_key`, `oauth_client`
   - Claim URI: `https://iopictures.com/oauth/claim`
2. **Identity Assertion (`identity_assertion`):**
   - Supported assertion types: `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
   - Supported credential types: `access_token`, `api_key`, `oauth_client`
   - Claim URI: `https://iopictures.com/oauth/claim`

## Credential Usage

When presenting credentials to protected endpoints, pass the bearer token in the `Authorization` HTTP header:

```http
Authorization: Bearer <access_token>
```

Supported scopes: `mcp:read`, `films:read`.
For licensing or partner API inquiries, contact `hello@iopictures.com`.