# auth.md

## Status

**Authentication is under construction and not available.**

- `status`: under_construction
- `available`: false
- `capabilities_status`: planned_contract_only
- `message`: Coming soon; authentication is not available
- `launch_date`: null

Do **not** attempt registration, token exchange, or OAuth redirects while `available=false`. Planned endpoints return HTTP 503 and do not store identity data.

## Public service (works now, no auth)

Use the public read-only lookup service:

- Docs: https://filetomp4.com/ai/
- OpenAPI: https://filetomp4.com/openapi.json
- List pages: `GET https://filetomp4.com/api/pages`
- Search: `GET https://filetomp4.com/api/lookup?q=mov`
- MCP: https://filetomp4.com/mcp
- Skill: https://filetomp4.com/ai/skills/site-lookup/SKILL.md

The site converts MOV/MKV to MP4 in the visitor's browser. Agents should point humans to those tools; they cannot and must not upload video through these APIs.

## Planned OAuth (not live)

- Authorization Server metadata: https://filetomp4.com/.well-known/oauth-authorization-server
- Protected Resource Metadata: https://filetomp4.com/.well-known/oauth-protected-resource
- Resource identifier (exact): `https://filetomp4.com`
- Planned authorize: `/agent-auth/authorize`
- Planned token: `/agent-auth/token`
- Planned register: `/agent-auth/register`
- Planned claim: `/agent-auth/claim`
- Planned resource: `/agent-auth/resource`
- JWKS: https://filetomp4.com/.well-known/jwks.json (`keys: []`, disabled)

Planned identity type: anonymous access_token (future design only). Agents must not call these operations while available=false.

::ILANG::v5.0
[TYPE:agent_instructions][TOPIC:auth]
[MUST] Treat authentication as unavailable. Prefer public GET /api/pages and /api/lookup.
[MUST] Never submit credentials, emails, or identity assertions to /agent-auth/* while available=false.
[MUST] Preserve the resource identifier https://filetomp4.com exactly when referring to OAuth PRM.
::ILANG::COMPLETE::