# auth.md

You are an agent. On the Hill Tutoring supports **agentic registration** for its public discovery and consultation-booking API.

Base resource: `https://www.onthehilltutoring.com/api`  
Authorization server: `https://www.onthehilltutoring.com`

## Step 1 — Discover

### 1a. Protected Resource Metadata

```http
GET https://www.onthehilltutoring.com/.well-known/oauth-protected-resource
```

Scopes:
- `services:read` — read service catalogue
- `consultation:book` — obtain or open a consultation booking link

Bearer method: `Authorization: Bearer <token>` (`header`).

### 1b. Authorization Server Metadata

```http
GET https://www.onthehilltutoring.com/.well-known/oauth-authorization-server
```

Follow the `agent_auth` block for registration endpoints.

## Step 2 — Register

```http
POST https://www.onthehilltutoring.com/agent/register
Content-Type: application/json

{
  "client_name": "your-agent",
  "redirect_uris": ["https://your-agent.example/callback"]
}
```

Supported identity types (from `agent_auth`):
- `anonymous` — obtain a limited access token for public service discovery
- `identity_assertion` — ID-JAG or verified email when available

## Step 3 — Claim (when required)

If registration returns a claim ceremony, complete it at:

`https://www.onthehilltutoring.com/agent/identity/claim`

## Step 4 — Token

```http
POST https://www.onthehilltutoring.com/oauth/token
```

Use grant types advertised in AS metadata (`authorization_code`, `client_credentials`, JWT-bearer, or claim grant).

## Step 5 — Call the API

```http
GET https://www.onthehilltutoring.com/api/services
Authorization: Bearer <access_token>
```

```http
GET https://www.onthehilltutoring.com/api/consultation
Authorization: Bearer <access_token>
```

Public documentation: https://www.onthehilltutoring.com/api/docs  
OpenAPI: https://www.onthehilltutoring.com/api/openapi.yaml  
Human booking fallback: https://calendly.com/nishenmenerapitiya/on_the_hill_tutoring

## Step 6 — Revocation

```http
POST https://www.onthehilltutoring.com/oauth/revoke
```

Revocation events (when subscribed): `https://schemas.workos.com/events/agent/auth/identity/assertion/revoked`

## Notes for agents

- Website content may be indexed for **search** and **ai-input**; **ai-train** is disallowed (see `/robots.txt` Content-Signal).
- Prefer `/llms.txt` and `Accept: text/markdown` for page content.
- Prefer WebMCP tools on the homepage for in-browser agent actions.