# auth.md

DroneFactory.ch supports public product discovery for AI agents through the same public shop pages and read-only discovery documents that browsers can use.

## Audience

This document is for AI agents that need to understand how to browse, compare and link to DroneFactory.ch products.

## Current Authentication Policy

DroneFactory.ch does not currently offer automated OAuth, OIDC or self-service agent credential registration for purchasing or account access.

Agents should use public product pages, public search, the WordPress REST API discovery endpoint, the WooCommerce Store API, the public DroneFactory agent REST endpoints and the public DroneFactory MCP endpoint for unauthenticated product discovery. Checkout, customer accounts, payment and order management remain human-facing website flows unless DroneFactory.ch explicitly provisions another integration.

## Agent Registration

Agent registration is available only through manual contact-based provisioning. DroneFactory.ch can review integration requests and decide whether a dedicated agent or partner workflow is appropriate.

Standalone registration flow:

- register_uri: https://www.dronefactory.ch/kontakt/
- registration_endpoint: https://www.dronefactory.ch/kontakt/
- registration_method: manual contact-based provisioning
- identity_types_supported: verified_email
- credential_types_supported: manual_review, privately_provisioned_token
- claim_uri: https://www.dronefactory.ch/kontakt/
- revocation_uri: https://www.dronefactory.ch/kontakt/
- credential_use: Credentials are not issued automatically. If DroneFactory.ch approves an integration, the credential type, allowed scopes, rotation process and revocation process are agreed directly before use.
- required_agent_details: operator name, verified email, intended use case, requested data or actions, security contact and expected request volume.

```yaml
agent_auth:
  skill: contact_provisioning
  register_uri: https://www.dronefactory.ch/kontakt/
  identity_types_supported:
    - verified_email
  credential_types_supported:
    - manual_review
  claim_uri: https://www.dronefactory.ch/kontakt/
```

## Public Discovery Endpoints

- Homepage: https://www.dronefactory.ch/
- Shop: https://www.dronefactory.ch/dronefactory-shop/
- Product search: https://www.dronefactory.ch/?s=SEARCH_TERM&post_type=product
- WordPress REST API: https://www.dronefactory.ch/wp-json/
- WooCommerce Store API products: https://www.dronefactory.ch/wp-json/wc/store/v1/products
- Public agent product search API: https://www.dronefactory.ch/wp-json/df-agent/v1/products?search=SEARCH_TERM&limit=10
- Public agent category API: https://www.dronefactory.ch/wp-json/df-agent/v1/categories
- Public MCP JSON-RPC endpoint: https://www.dronefactory.ch/wp-json/df-agent/v1/mcp
- MCP discovery card: https://www.dronefactory.ch/.well-known/mcp.json
- UCP cart handoff profile: https://www.dronefactory.ch/.well-known/ucp
- Public cart handoff API: https://www.dronefactory.ch/wp-json/df-agent/v1/carts
- API catalog: https://www.dronefactory.ch/.well-known/api-catalog
- Agent skills index: https://www.dronefactory.ch/.well-known/agent-skills/index.json
- MCP server card: https://www.dronefactory.ch/.well-known/mcp/server-card.json

## Agent Guidance

- Use live product pages for current price, stock and availability.
- Prices are in CHF.
- Public cart handoff only creates a user-facing DroneFactory.ch cart link. It does not authorize payment, complete checkout, access accounts or place orders.
- Do not infer product compatibility unless it is explicitly stated on the product page or in manufacturer data.
- Do not invent delivery dates or ETA promises for backorder products.
- Contact DroneFactory.ch for product questions, compatibility checks, order support or replacement recommendations.