# auth.md

You are an agent. This document explains how to authenticate a user against ScrollLaunch (https://www.scrolllaunch.com) so you can act on their behalf (for example, to submit a product launch).

ScrollLaunch delegates identity to **Google OAuth** and issues a session credential via NextAuth. Registration is **interactive** — a human signs in; there is no fully autonomous, headless registration path. Plan your flow around handing the user a sign-in link and continuing once the session exists.

## Audience

- This applies to agents acting on behalf of a human maker who wants to use ScrollLaunch (submit/manage a product launch, manage their dashboard).
- Public, unauthenticated reads (live products, search, leaderboard) need no registration — see https://www.scrolllaunch.com/.well-known/agent-skills/index.json and https://www.scrolllaunch.com/llms.txt.

## Discovery

- **Protected Resource Metadata (RFC 9728):** `https://www.scrolllaunch.com/.well-known/oauth-protected-resource` — lists the `resource`, `authorization_servers`, `scopes_supported`, and `bearer_methods_supported`.
- **Authorization Server Metadata (RFC 8414):** `https://www.scrolllaunch.com/.well-known/oauth-authorization-server` — carries the `issuer` plus the `agent_auth` block described below.

## Registration method

ScrollLaunch supports a single registration method: **interactive sign-in with a Google-verified email**.

- `identity_types_supported`: `identity_assertion`
- `identity_assertion.assertion_types_supported`: `verified_email` (asserted by Google OAuth)
- `credential_types_supported`: `oauth_session_cookie` (a NextAuth-signed session JWT)
- `register_uri` / `claim_uri`: `https://www.scrolllaunch.com/auth/signin`

## Flow

1. **Hand off to the user.** Surface the sign-in URL and ask the user to complete it: `https://www.scrolllaunch.com/auth/signin?callbackUrl=<return path>`. To deep-link the maker straight into product submission, set `callbackUrl=/dashboard/products/new`.
2. **User authenticates.** The user signs in with Google (this is the verified-email assertion and the only consent gate). Google must report the email as verified.
3. **Session established.** ScrollLaunch issues a NextAuth session cookie scoped to the user's account. The session can be inspected at `https://www.scrolllaunch.com/api/auth/session`.
4. **Act within the session.** Authenticated, same-origin requests to `/api/*` and `/dashboard/*` are authorized by that session cookie. There is no separate bearer-token issuance step — the cookie is the credential.

## Credential use

- The credential is a browser session cookie set on the ScrollLaunch origin; send it as a cookie on same-origin requests. It is not a portable bearer token and should not be copied across origins.
- Sessions are short-lived and refreshed by NextAuth. When a request returns `401`, restart at the sign-in step rather than retrying.
- To end a session, send the user to `https://www.scrolllaunch.com/auth/signout`.

## Not supported

- ID-JAG (`urn:ietf:params:oauth:token-type:id-jag`) identity assertions and the JWT-bearer token-exchange grant.
- Anonymous registration and the RFC 8628-style device-code claim ceremony.
- Programmatic / headless account creation. Do not probe for `POST /agent/identity` or similar endpoints — they are not served. This document and the OAuth metadata above are the source of truth.

## Contact

- Auth / agent-integration enquiries: kalashvasaniya@gmail.com