# Curatoria auth.md

Curatoria is an x402 commerce API for creator-owned design catalogs. Buyer agents pay per asset in USDC on Base; operator admin routes use an API key.

## Discovery

- Protected Resource Metadata: `https://curatoria.dev/.well-known/oauth-protected-resource`
- Authorization Server Metadata: `https://curatoria.dev/.well-known/oauth-authorization-server`
- Agent integration guide: `https://curatoria.dev/llms.txt`
- OpenAPI description: `https://curatoria.dev/.well-known/openapi.json`

## Supported registration methods

### anonymous (buyer agents)

No user account or OAuth access token is required. Register for access by configuring an x402-capable wallet and following the free catalog at `/.well-known/design-catalog.json`.

- **Credential type:** `x402_payment_signature` via the `PAYMENT-SIGNATURE` header after HTTP 402 on paid routes
- **Register URI:** `https://curatoria.dev/.well-known/agent/register`
- **Network:** base
- **Facilitator:** https://api.cdp.coinbase.com/platform/v2/x402

### admin:publish (operators only)

Admin credentials are provisioned out of band. Send `X-Admin-Key` on `POST /admin/publish` and `GET /admin/facilitator-preflight`.

## Scopes

| Scope | Audience | Use |
| --- | --- | --- |
| `admin:publish` | Operators | Publish or update catalog entries |

## Claim and revocation

- **Claim URI:** `https://curatoria.dev/.well-known/agent/claim` — user-claimed binding is not used for buyer x402 access
- **Revocation URI:** `https://curatoria.dev/.well-known/agent/revoke` — rotate admin keys out of band; x402 payments are per request

## Policies

- Privacy: `https://curatoria.dev/privacy.html`
- Setup guide: `https://curatoria.dev/starter-guide.html`