---
title: "Auth — Hormaz Daruwala Portfolio Agents"
description: "How AI agents obtain credentials: anonymous, identity_assertion (ID-JAG), service_auth. Endpoints, errors, revocation."
canonical: "https://hormazdaruwala.vercel.app/auth.md"
last-updated: "2026-10-07"
---
# Auth — Hormaz Daruwala Portfolio Agents

How agents obtain credentials for hormazdaruwala.vercel.app. Spec keywords: agent_auth, identity_endpoint, identity_assertion, service_auth, id-jag, WWW-Authenticate.

## Discover
- Protected-resource metadata (RFC 9728): GET /.well-known/oauth-protected-resource → {resource, authorization_servers, scopes_supported}.
- Authorization-server metadata (RFC 8414): GET /.well-known/oauth-authorization-server → {issuer, claim_endpoint, identity_endpoint, events_endpoint, agent_auth}.
- agent_auth block: {identity_endpoint, identity_types_supported: ["anonymous","identity_assertion","service_auth"], identity_assertion: {assertion_types_supported: ["urn:ietf:params:oauth:token-type:id-jag"]}, skill: "/auth.md"}.
- Unauthenticated calls to /api, /api/v1, /v1, /v2, /agent/identity, /agent/auth return 401 with WWW-Authenticate: Bearer resource_metadata="<prm-url>".

## Pick a method
- anonymous: demos only. No credential; claim with identity_type=anonymous.
- identity_assertion: production agents. Mint an ID-JAG (urn:ietf:params:oauth:token-type:id-jag) from your IdP and exchange it.
- service_auth: first-party services. Use a client-credentials assertion.

## Register
No pre-registration for reads. For agent actions, POST your assertion to the claim endpoint to receive a scoped token. See claim_endpoint in AS metadata.

## Claim
POST /api/agent/claim Content-Type: application/json {"assertion":"<id-jag-or-service-credential>","identity_type":"identity_assertion"} → 200 {"access_token":"...","token_type":"Bearer","expires_in":3600}.

## Exchange
Demo mint: POST /api/agent/identity → {"access_token":"demo-token-anonymous"}. Claim exchange above is the supported path.

## Use the access_token
Send Authorization: Bearer <access_token> or x-api-key: <token> to /api, /api/v1, /agent/identity, /agent/auth. Missing/invalid credentials return 401 JSON {error:{code,message,hint}} with WWW-Authenticate header.

## Errors
JSON {error:{code,message,hint,docs}}. Codes: invalid_json, invalid_assertion, unsupported_identity_type, unauthorized. Each hint names the /auth.md section to re-read. Request Accept: text/markdown for markdown errors.

## Revocation
POST /api/agent/events {"event":"revoke","token":"..."} or email hormazdaruwala86@gmail.com. Demo tokens expire in 1h.