# auth.md — instantagentmessage.ai (GreenCore Solutions Corp.)

## Posture

Public content and machine files on this surface are **open by design** — no
authentication is required to read pages, kit JSONs, llms.txt or markdown twins.
Discovery endpoints (/.well-known/*) are public.

Lodging an Instant Agent Message is open: the transaction MCP at https://mcp.cpghumanintheloop.ai/mcp accepts
`submit_rfq`, `request_terms` and `escalate` from any agent that stamps a requester name and
reply channel. Reading and answering messages is a human act behind **Microsoft Entra** at the
desk (https://ia-message.ai/). Transactional agentic commerce is authorized at the **GSC Navigator boundary**
using **Microsoft Entra OAuth 2.0** (2-factor; caller identity stamped; a human signs every
commit — Human-in-the-Loop by design).

## Protected resource

- Resource: https://instantagentmessage.ai
- Protected Resource Metadata: [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- Authorization server (Microsoft Entra): https://login.microsoftonline.com/54939635-2f2e-465a-8526-a907cb3c8ebd/v2.0
- AS metadata mirror: [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server) · OIDC: [/.well-known/openid-configuration](/.well-known/openid-configuration)
- Web Bot Auth key directory: [/.well-known/http-message-signatures-directory](/.well-known/http-message-signatures-directory)
- Bearer tokens are presented in the Authorization header.

## Agent registration (self-contained flow)

- **Agent audience:** AI procurement agents and their operators that lodge Instant Agent Messages
  on the transaction MCP (https://mcp.cpghumanintheloop.ai/mcp) and integrate with the SPARKS CPG Knowledge Graph
  (https://mcp.cpgknowledgegraph.ai/mcp) for CPG retail-grocery transactions.
- **Registration endpoint:** https://instantagentmessage.ai/#contact — the surface's live contact form
  (POST https://formspree.io/f/xnpagnrl with fields name, email, message). There is no
  self-serve dynamic client registration; every registration is human-reviewed.
- **Supported method — verified email:** GSC verifies the operator's work email
  from the registration message, then provisions credentials after review.
- **Credential use:** GSC issues **Microsoft Entra OAuth 2.0 client credentials**
  (client_credentials grant against the issuer above). Agents present the access
  token as a **Bearer token in the Authorization header** on transactional calls
  at the GSC Navigator boundary. Revocation is immediate on operator request via
  the same contact endpoint.

```json
{
  "agent_auth": {
    "skill": "https://instantagentmessage.ai/auth.md",
    "register_uri": "https://instantagentmessage.ai/#contact",
    "identity_types_supported": [
      "identity_assertion"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "verified_email"
      ],
      "credential_types_supported": [
        "oauth2_client_credentials"
      ]
    },
    "claim_uri": "https://instantagentmessage.ai/#contact"
  }
}
```

Operator: GreenCore Solutions Corp. · D-U-N-S 24-336-6774 · Microsoft AI Cloud Partner.
Desk: https://ia-message.ai/ · Transaction MCP: https://mcp.cpghumanintheloop.ai/mcp