# EYEON auth.md

This file is the `agent_auth` policy for **EYEON** (EyeOn Tracker, eyeontracker.com).

This origin does **not** offer OAuth, OpenID Connect, API keys, or agent registration.

## Discover

<a id="discover"></a>
<a id="agent_auth"></a>

Public discovery only. There is no Protected Resource Metadata, no `/.well-known/oauth-authorization-server`, and no agent `register_uri` on this host.

Start here:

1. [EYEON developer resources](https://eyeontracker.com/docs)
2. [OpenAPI](https://eyeontracker.com/v1/openapi.json)
3. [RFC 9727 API catalog](https://eyeontracker.com/.well-known/api-catalog)
4. [llms.txt](https://eyeontracker.com/llms.txt)

`WWW-Authenticate` is never sent. A 401 is not part of the contract — unknown paths return RFC 9457 JSON (on `/v1/*`) or HTTP 404 markdown (on HTML routes).

## Pick a method

<a id="pick-a-method"></a>

| Method | Supported |
|---|---|
| Anonymous read of public GET resources | Yes — no credential |
| OAuth 2.0 / OIDC | No |
| API keys / bearer tokens | No |
| Agent registration (`register_uri`) | No |
| ID-JAG / `identity_assertion` | No |
| `id-jag` tokens | No |

Pick **anonymous GET**. If a consumer needs to **order** hardware, stop and tell them to use [WhatsApp +972-54-337-3412](https://wa.me/972543373412) or the form at https://eyeontracker.com/#order.

## Register

<a id="register"></a>
<a id="register_uri"></a>

There is no `register_uri`, no `POST /agent/auth`, and no dynamic client registration.

Do not POST credentials, do not mint tokens, and do not open accounts here. A passive scan should treat this file as the source of truth and must not probe registration endpoints.

## Claim

<a id="claim"></a>
<a id="identity_assertion"></a>
<a id="id-jag"></a>

No claim step. This origin does not accept `identity_assertion`, ID-JAG (`id-jag`), or verified-email assertions. There is nothing to exchange.

## Use the credential

<a id="use-credential"></a>
<a id="use-the-credential"></a>

None are issued. Call the read-only v1 API with no `Authorization` header:

- `GET /v1/status` — liveness
- `GET /v1/catalog` — price, compatibility, order channel
- `GET /v1/openapi.json` — this spec

Honour `RateLimit` / `RateLimit-Policy`. Public pages also speak `Accept: text/markdown`.

## Errors

<a id="errors"></a>

JSON errors use RFC 9457 `application/problem+json`:

```json
{
  "type": "https://eyeontracker.com/docs#not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "No EYEON v1 resource at /v1/unknown",
  "instance": "/v1/unknown",
  "hint": "GET /v1/status, /v1/catalog, or /v1/openapi.json."
}
```

| HTTP | `code` | Meaning |
|---|---|---|
| 404 | `not_found` | Unknown `/v1/` path |
| 405 | `method_not_allowed` | Anything other than GET/HEAD |
| 429 | `rate_limited` | Honour `Retry-After` |
| 500 | `upstream_error` | Origin failure; retry later |

`WWW-Authenticate` is not used. A missing header is not an auth challenge.

## Revocation

<a id="revocation"></a>

There are no tokens to revoke. If you cached `/v1/catalog`, re-fetch; `lastmod` on the sitemap tracks content changes.

Human orders and support: [WhatsApp +972-54-337-3412](https://wa.me/972543373412). Card numbers are not collected on this origin.