# auth.md

You are an agent. This document describes how to authenticate with **MyCloudConvert** (`https://www.mycloudconvert.com`).

## Important policy

MyCloudConvert’s core product is **browser-based** file conversion, compression, resize, merge, and video/audio tools. Files are processed on the user’s device. There is **no server-side file-upload conversion API** and **no API keys** for converting files.

Public HTTP APIs (`/api/health`, `/api/contact`, `/api/blog`) are intentionally open and **do not require** OAuth bearer tokens for normal use.

Agent registration endpoints exist for **discovery compliance** and return structured responses explaining this policy. Prefer WebMCP / browser navigation for tools.

## Discovery

### Protected Resource Metadata

```http
GET https://www.mycloudconvert.com/.well-known/oauth-protected-resource
```

### Authorization Server Metadata

```http
GET https://www.mycloudconvert.com/.well-known/oauth-authorization-server
```

Also available:

```http
GET https://www.mycloudconvert.com/.well-known/openid-configuration
```

Skill URI (this file): `https://www.mycloudconvert.com/auth.md`

## Registration

Register via:

```http
POST https://www.mycloudconvert.com/agent/register
Content-Type: application/json

{ "client_name": "your-agent", "redirect_uris": [] }
```

Supported identity type for discovery: **anonymous** (see `agent_auth` in authorization-server metadata).

Expected outcome: JSON explaining that conversion does not use OAuth credentials, with links to `/docs/api` and tool URLs. No long-lived API key is issued for file conversion.

## Identity / claim

```http
POST https://www.mycloudconvert.com/agent/identity
POST https://www.mycloudconvert.com/agent/identity/claim
POST https://www.mycloudconvert.com/oauth2/token
POST https://www.mycloudconvert.com/oauth2/revoke
```

These endpoints document the Auth.md surface. They do not mint credentials for uploading files to convert on the server.

## How to use MyCloudConvert as an agent

1. Discover tools via `/.well-known/ai-catalog.json`, `/.well-known/agent-skills/index.json`, or WebMCP on page load.
2. Navigate users to tool paths such as `/png-to-jpg`, `/compress`, `/convert-video`.
3. Use `POST /api/contact` for human support; `GET /api/blog` for published posts; `GET /api/health` for status.
4. Do not attempt to POST binary files to `/api/*` for conversion.