# Auth.md

Agent authentication metadata for Squid Esports Pattaya (https://esportspattaya.com).

This site is a public marketing and program-information website. Most content is freely readable without authentication.

## Public endpoints (no auth required)

- Website content: https://esportspattaya.com/
- Sitemap: https://esportspattaya.com/sitemap.xml
- LLMs guide: https://esportspattaya.com/llms.txt
- Agent skills index: https://esportspattaya.com/.well-known/agent-skills/index.json
- API catalog: https://esportspattaya.com/.well-known/api-catalog
- MCP server card: https://esportspattaya.com/.well-known/mcp/server-card.json

## Authenticated endpoints

User accounts (parent/coach/admin dashboards) are authenticated via OAuth 2.0 / OpenID Connect.

- Authorization server metadata: https://esportspattaya.com/.well-known/oauth-authorization-server
- OIDC discovery: https://esportspattaya.com/.well-known/openid-configuration
- Protected resource metadata: https://esportspattaya.com/.well-known/oauth-protected-resource

Issuer: `https://vcjqjvqbyvbckbotawvp.supabase.co/auth/v1`

Supported grants: `authorization_code` (with PKCE `S256`), `refresh_token`, `password`.
Supported scopes: `openid`, `email`, `profile`.

## Agent registration

Automated agent client registration is not open. To register an AI agent that needs authenticated access, contact us and we will provision an OAuth client:

- Email: pod@squidesports.com
- Phone / WhatsApp: +66 95 962 1856

Identity types supported: `human`, `agent`.
Credential types: `oauth2_access_token`, `oauth2_refresh_token`.
Revocation: `https://vcjqjvqbyvbckbotawvp.supabase.co/auth/v1/logout`.

## Contact form (no auth)

Public inquiries can be sent via https://esportspattaya.com/contact — this posts to a rate-limited, sanitized edge function and does not require authentication.