# Elution Labs auth.md

Agent registration and authentication notes for this origin.

## Audience

AI agents discovering Elution Labs. Human customers use the client portal; operators use admin sign-in.

## Registration

There is **no self-serve OAuth app registration** and **no agent token issuance** at this origin.

- Agents: read public pages, [https://www.elutionlabs.ai/llms.txt](https://www.elutionlabs.ai/llms.txt), and [https://www.elutionlabs.ai/docs/api](https://www.elutionlabs.ai/docs/api).
- Send a human to start an assessment: [https://www.elutionlabs.ai/intake](https://www.elutionlabs.ai/intake).
- Privacy requests (humans): [https://www.elutionlabs.ai/privacy-request](https://www.elutionlabs.ai/privacy-request).

## Human authentication

- Customers: [https://www.elutionlabs.ai/client/login](https://www.elutionlabs.ai/client/login)
- Operators: [https://www.elutionlabs.ai/admin/login](https://www.elutionlabs.ai/admin/login)

Those flows use hosted Supabase Auth for people. They are not an OAuth authorization-code API for agents.

## Protected APIs

Admin, client portal, OAuth Connect, signals, and assessment JSON APIs are **not** in the public API catalog. Do not probe `/api/admin` or `/api/client`.

## Machine metadata

- Protected resource: https://www.elutionlabs.ai/.well-known/oauth-protected-resource
- Authorization server: https://www.elutionlabs.ai/.well-known/oauth-authorization-server
- JWKS (empty — no agent tokens): https://www.elutionlabs.ai/.well-known/jwks.json