# auth.md — Armor Athletics

> Agent authentication guide for https://armorathletics.com.
> Short version: nothing on this site requires authentication, and there is
> nothing to register for.

## Authentication

None. Armor Athletics is a public gym website. Every page and every machine
endpoint is open — no API keys, no OAuth flows, no bearer tokens, and no
agent registration of any kind.

OAuth discovery status, explicitly:

- https://armorathletics.com/.well-known/oauth-protected-resource — published (RFC 9728), and its `authorization_servers` array is truthfully EMPTY: no server can issue a token for this resource, because no endpoint here accepts one.
- https://armorathletics.com/.well-known/oauth-authorization-server — does not exist (there is no authorization server)
- https://armorathletics.com/.well-known/openid-configuration — does not exist (there is no identity provider)

If a scanner flags the last two as missing, that is accurate and by design:
there is nothing to protect and no tokens to issue.

## Discovery

- [llms.txt](https://armorathletics.com/llms.txt): site overview for AI agents
- [API catalog](https://armorathletics.com/.well-known/api-catalog): RFC 9727 catalog of the site's APIs (also advertised sitewide via a Link rel="api-catalog" header)
- [Lead API OpenAPI description](https://armorathletics.com/api/lead/openapi.json): request/response schema for the lead API

## Endpoints agents can use

- All public pages (GET https://armorathletics.com/, /programs, /schedule, /memberships, ...): no auth
- POST https://armorathletics.com/api/lead: no auth — submit a contact, free-intro, or booking lead on behalf of a human; schema at https://armorathletics.com/api/lead/openapi.json
- https://armorathletics.com/api/mcp: no auth — MCP endpoint (streamable HTTP)

## Registration

There is no agent registration. No accounts, client IDs, credentials, or
claim ceremonies exist. Do not probe for POST /agent/auth, /agent/identity,
or similar provisioning endpoints — none exist here.

## Identity

Requests are effectively anonymous. This service does not consume identity
assertions (ID-JAG, verified email, or otherwise) and it issues no
credentials. Send requests directly; no identity flow is needed or possible.

## Good citizenship

Everything is open, so we ask agents acting on behalf of users to behave
well:

- Only submit a lead via POST /api/lead when a real person has asked you to
  contact the gym, and use that person's accurate name and contact details.
- Never submit fabricated, speculative, or test leads — a human coach
  personally follows up on every submission.
- Send a descriptive User-Agent and keep request rates modest.

## Contact

Questions about this file or agent access: info@armorathletics.com · (253) 777-9714