# auth.md

Bonus Hediye agent authentication & registration notes.

## Audience

AI agents and automated clients consuming **public read-only** content on `bonushediye.online`.

## Registration required?

**No** for `GET /api/*`, OpenAPI, guides, and static pages. These resources are public.

Optional anonymous agent registration exists only to obtain a lightweight bearer token for future rate-limit identity:

- Register: `POST /agent/register` with JSON `{ "client_name": "my-agent" }`
- Claim token: `POST /agent/claim` (or use token returned from register)
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- Protected resource metadata: `/.well-known/oauth-protected-resource`

## Supported methods

1. **Anonymous** — `identity_types_supported: ["anonymous"]` — issue opaque public bearer
2. **None** — omit Authorization header for public GET

## Credential use

If a token is issued, send:

```
Authorization: Bearer <token>
```

Scopes: `public:read`

## Human / affiliate notes

Outbound casino/bahis links may be affiliate links. See [/metodoloji/](https://bonushediye.online/metodoloji/). Site is 18+ informational; it does not operate betting.