# DOA Enerji — Agent Authentication Guide

> Source of truth for AI agents (Auth.md spec, WorkOS draft).
> This file describes how to authenticate against DOA Enerji's public and protected APIs.

## Public Endpoints (No Auth Required)

The following endpoints are open to anonymous agents:

| Endpoint | Description |
|---|---|
| `GET /api/public/products` | Product catalog (slim by default) |
| `GET /api/public/services` | EPC services list |
| `GET /api/public/news` | Blog/news articles |
| `GET /api/public/references` | Project references |
| `GET /api/public/slides` | Hero slider content |
| `GET /api/public/exchange-rates` | TCMB exchange rates |
| `GET /api/health` | Service health check |

Rate-limit: 60 requests/min/IP (Cloudflare-enforced). No registration needed.

## Customer Portal (Magic-Link Token)

The customer portal uses **one-time magic links** rather than agent-style OAuth:

```
GET /api/portal/q/{token}
```

A `{token}` is issued only via signed sales emails (RFC 4648 base64url, 32 bytes entropy, 90-day TTL). Agents cannot self-register. If the customer wants an agent to access their quote, they share the link with the agent.

**Audit log**: every view, download, and chat interaction is recorded.

## Admin API (`/api/admin/*`)

Restricted to internal staff. Authentication via:
- JWT bearer tokens (`Authorization: Bearer <jwt>`)
- Issued only via `POST /api/auth/login` with admin credentials
- Not available to AI agents

## Agent Registration

DOA Enerji does **not currently expose an agent registration endpoint**.

If you are an automated agent that needs deeper integration:
1. Contact `info@doaenerji.com.tr` describing your use case
2. We will issue a scoped API key (manually) with rate-limit quota
3. Use as: `X-Agent-Token: <issued-key>`

## OAuth / OIDC (Roadmap)

Discovery metadata published at:
- `/.well-known/openid-configuration` (planned 2026 Q3)
- `/.well-known/oauth-authorization-server` (planned 2026 Q3)

## Verification

- Site identity: see `/.well-known/security.txt` (RFC 9116)
- Content licensing: see `/robots.txt` (`Content-Signal: ai-train=no, search=yes, ai-input=yes`)
- API catalog: see `/.well-known/api-catalog`
- Agent skills: see `/.well-known/agent-skills/index.json`
- MCP server card: see `/.well-known/mcp/server-card.json`

## Contact

| Role | Address |
|---|---|
| Tech | tech@doaenerji.com.tr |
| Security | security@doaenerji.com.tr (see `/.well-known/security.txt`) |
| General | info@doaenerji.com.tr |