---
title: "ChristianPicks authentication"
description: "Agent auth discovery for ChristianPicks, including oauth-protected-resource, oauth-authorization-server, agent_auth, and register_uri."
canonical: "https://christianpicks.com/auth.md"
last-updated: "2026-08-28"
---
# Auth.md — ChristianPicks authentication

ChristianPicks public catalog resources are read-only. Agents should discover auth through RFC 9728 protected-resource metadata, RFC 8414 authorization-server metadata, and this skill. The `agent_auth` block advertises `register_uri` and anonymous credentials.

## Discover

1. Fetch the protected-resource metadata at https://christianpicks.com/.well-known/oauth-protected-resource (`oauth-protected-resource`).
2. Follow `authorization_servers` to https://christianpicks.com/.well-known/oauth-authorization-server (`oauth-authorization-server`).
3. Read the `agent_auth` object. `identity_types_supported` is `anonymous`. `register_uri` is https://christianpicks.com/oauth/register.
4. A 401 from https://christianpicks.com/api/agent/auth includes `WWW-Authenticate: Bearer resource_metadata="https://christianpicks.com/.well-known/oauth-protected-resource"`.

The catalog GET API itself does not require a bearer token. Anonymous access is the default.

## Pick a method

Supported identity type:

- `anonymous` — no user account. Optional `access_token` from client_credentials identifies the agent for rate limits.
- `identity_assertion` is not offered. Do not send `id-jag` assertions.

`anonymous.credential_types_supported` is `access_token`.

## Register

POST https://christianpicks.com/oauth/register

```json
{
  "client_name": "your-agent",
  "identity_type": "anonymous",
  "grant_types": ["client_credentials"],
  "token_endpoint_auth_method": "none"
}
```

The response includes `client_id`. `token_endpoint_auth_method` is `none`.

## Claim

GET or POST https://christianpicks.com/oauth/claim

Anonymous catalog access does not require a human claim step. The claim endpoint returns `status: not_required` and points at the token endpoint.

## Use the credential

POST https://christianpicks.com/oauth/token

```json
{
  "grant_type": "client_credentials",
  "client_id": "{client_id}",
  "scope": "catalog:read"
}
```

Send `Authorization: Bearer {access_token}` if you requested a token. Catalog GET endpoints also accept requests with no Authorization header.

Authorization endpoint: https://christianpicks.com/oauth/authorize

Scopes:

- `catalog:read` — public catalog surface described by OpenAPI.

## Errors

Protected discovery endpoints return JSON:

```json
{
  "error": {
    "code": "unauthorized",
    "message": "Bearer token required for this resource.",
    "hint": "Fetch /.well-known/oauth-protected-resource or /auth.md"
  }
}
```

A 401 includes `WWW-Authenticate: Bearer resource_metadata="https://christianpicks.com/.well-known/oauth-protected-resource"`. Invalid JSON or unknown grants return `invalid_request` or `unsupported_grant_type`.

## Revocation

POST https://christianpicks.com/oauth/revoke

```json
{
  "token": "{access_token}"
}
```

The internal scrape endpoints under `/api/scrape` require a server-issued `X-API-KEY` and are not part of agent registration.