# Zaryab Storefront — auth.md

Authentication and authorization discovery guide for autonomous agents interacting with https://zaryab.net.

## Public Storefront & Catalog Access (No Credentials Required)

- **Storefront MCP**: `POST https://zaryab.net/api/mcp` accepts unauthenticated JSON-RPC 2.0 requests for policy, FAQ, and store inquiries.
- **UCP Discovery**: `GET https://zaryab.net/.well-known/ucp` is publicly readable.
- **Agent Discovery Manifests**: All manifests under `https://agents.zaryab.net/.well-known/*` are publicly readable with CORS enabled.

## Customer Identity & Buyer-Authorized Checkout

- **OIDC / OAuth Discovery**: `https://zaryab.net/.well-known/openid-configuration` and `https://zaryab.net/.well-known/oauth-authorization-server` (Shopify Customer Accounts issuer `https://shopify.com/authentication/74940219625`).
- **OAuth Protected Resource**: `https://zaryab.net/.well-known/oauth-protected-resource`.
- **UCP Checkout MCP**: `POST https://zaryab.net/api/ucp/mcp` requires an agent profile declaration in `meta.ucp-agent.profile` and hands off final order confirmation and payment authorization directly to the human buyer.