# auth.md

Agent access to **JustIdea Prestashop DEMO**. Most of this store is readable without any credentials; only the MCP endpoint needs a token, and that token is issued by the store owner rather than by an authorization server.

## Discover

Machine-readable metadata:

```http
GET https://prestashop.justidea.dev/.well-known/oauth-protected-resource
GET https://prestashop.justidea.dev/.well-known/oauth-authorization-server
GET https://prestashop.justidea.dev/.well-known/api-catalog
GET https://prestashop.justidea.dev/.well-known/agent-skills/index.json
```

No credentials are required for any of the above, nor for [llms.txt](https://prestashop.justidea.dev/llms.txt), the [agent sitemap](https://prestashop.justidea.dev/agent-sitemap.xml), or any page requested with `Accept: text/markdown`.

## Pick a method

| Method | Supported here | Notes |
| --- | --- | --- |
| `anonymous` | yes | Catalogue, prices, stock, shipping and policies. No token. |
| `service_auth` | manual only | A bearer token issued by the store owner. See Register. |
| `identity_assertion` | no | This store runs no authorization server, so there is no ID-JAG exchange and no token endpoint. |

## Register

Registration is **manual and out of band**. There is no enrolment endpoint to POST to — a document claiming otherwise would send you into a dead end.

1. Contact the store owner: say which agent you are and what you need the access for.
2. The owner generates a bearer token in the PrestaShop Back Office (Modules → AgentReady → MCP server).
3. The owner sends you the token over a channel you both trust.

## Use the access_token

```http
POST https://prestashop.justidea.dev/agent/mcp
Authorization: Bearer <token>
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list"}
```

The token does not expire on a timer and there is no refresh flow — it stays valid until the owner regenerates it.

## Errors

| Status | Meaning | What to do |
| --- | --- | --- |
| `401` | Missing or wrong token. | Read `WWW-Authenticate`; it points at the Protected Resource Metadata. Ask the owner for a current token. |
| `403` | The store owner blocked your agent. | Respect it. Do not retry with a different user agent. |
| `404` | The feature is switched off on this store. | Treat as absent, not as an outage. |
| `405` | Wrong method on the MCP endpoint. | It accepts POST only. |
| `429` | Rate limited. | Wait for `Retry-After` seconds. |
| `503` | Temporary failure generating a document. | Retry with backoff. |

## Revocation

- The owner revokes access by regenerating the token in the Back Office, which invalidates the previous one immediately. Expect `401` from then on.
- Access can also be withdrawn per agent in robots.txt; a `403` means exactly that.
- Every tool here is **read-only** — nothing writes a cart, an order or customer data — so a leaked token exposes catalogue information the store already publishes.