# Vistaire auth.md

Vistaire publishes this file so agents can understand the current authentication and registration posture without guessing.

## Service

- Name: Vistaire
- Base URL: https://www.vistaire.ca/
- Contact: contact@vistaire.ca

## Public agent access

- Public site pages, the API catalog, this auth.md file, MCP Server Card, and Agent Skills documents are available without authentication.
- Public read-only menu media endpoints may be used when linked from public menu pages.
- Vistaire does not currently provide self-service agent registration, OAuth dynamic client registration, or an agent credential issuance endpoint.

## Authentication model

- Owner routes and owner APIs are protected by Clerk session authentication and a Vistaire owner allowlist.
- The /admin preview is a public noindex demonstration surface, not an advertised agent API and not owner-authenticated production tooling.
- Supabase is used for data and storage; the public Supabase project URL/key are not an OAuth issuer for Vistaire agent access.
- The repo does not define a Vistaire-operated OAuth authorization server, credential endpoint, JWKS endpoint, OIDC issuer, bearer credential API access, or public OAuth scopes for agents.
- No agent_auth block is published because there is no real register URI, credential issuance flow, or supported identity assertion flow in this repository.

## Registration process

- Registration status: manual review only.
- Supported identity types for agents: none documented for self-service use.
- Credential types for agents: none issued by Vistaire self-service flows.
Contact contact@vistaire.ca or use https://www.vistaire.ca/prendre-rendez-vous for partnership or integration access.
Do not attempt automated account creation or owner/admin route probing.

## Discovery endpoints

- API catalog: https://www.vistaire.ca/.well-known/api-catalog
- OAuth Protected Resource Metadata: https://www.vistaire.ca/.well-known/oauth-protected-resource
- OAuth Authorization Server Metadata: not published because Vistaire has no OAuth authorization server.
- OpenID Connect Discovery: not published because Vistaire has no Vistaire-operated OIDC issuer.
- MCP Server Card: https://www.vistaire.ca/.well-known/mcp/server-card.json
- Agent Skills index: https://www.vistaire.ca/.well-known/agent-skills/index.json

## Safety and privacy

- Do not submit contact forms, upload files, delete content, change menus, or trigger owner workflows without explicit human instruction.
- Do not collect or infer non-public owner data from protected endpoints.
- Treat public menu media as read-only presentation assets.