# Broteenz™ AI Agent Authentication & Registration (Auth.md)

This document provides instructions for AI agents, crawlers, and automated clients to interact with Broteenz™ APIs.

## Public Actions (No Auth Required)
- **Batch 001 VIP Secret Drop Registration**: `POST https://broteenz.com/api/subscribe`
  - Body: `{ "email": "agent@example.com" }`
  - Generates instant VIP clearance pass: `PASS #BRTZ-XXXX`
  - Rate limit: 60 requests/minute per IP.

## Protected Endpoints
- **Leads Vault Export**: `GET https://broteenz.com/api/leads-export`
  - Requires: `Authorization: Bearer <ADMIN_SECRET_KEY>` or header `x-admin-key: <ADMIN_SECRET_KEY>`.

## OAuth 2.0 & RFC Discovery
- **API Catalog**: `https://broteenz.com/.well-known/api-catalog` (RFC 9727)
- **Protected Resource**: `https://broteenz.com/.well-known/oauth-protected-resource` (RFC 9728)
- **Authorization Server**: `https://broteenz.com/.well-known/oauth-authorization-server` (RFC 8414)
- **MCP Server Card**: `https://broteenz.com/.well-known/mcp/server-card.json` (SEP-1649)
- **Agent Skills Discovery**: `https://broteenz.com/.well-known/agent-skills/index.json` (RFC v0.2.0)