# auth.md

> Agent authentication reference for **https://www.avidorganics.net**

## Overview

Avid Organics is a leading specialty chemicals manufacturer. This site publishes product information, technical content, news, and media. Most resources are publicly accessible without authentication.

## Public resources (no auth required)

The following APIs and pages are fully public:

- Product catalog pages: `https://www.avidorganics.net/en/products/...`
- Blog, news, and events: `https://www.avidorganics.net/api/blogs`, `https://www.avidorganics.net/api/news`, `https://www.avidorganics.net/api/events`
- Technical downloads index: `https://www.avidorganics.net/en/media/downloads`
- Contact form: `POST https://www.avidorganics.net/api/contact-us`
- Agent discovery: `https://www.avidorganics.net/.well-known/api-catalog`, `https://www.avidorganics.net/.well-known/agent-skills/index.json`
- MCP server card: `https://www.avidorganics.net/.well-known/mcp/server-card.json`
- LLM context: `https://www.avidorganics.net/llms.txt`, `https://www.avidorganics.net/llms-full.txt`

Agents may consume these freely. No registration, token, or credential is needed.

## Authenticated resources

Some endpoints require a bearer token obtained via the OAuth token endpoint:

- Customer profile and account details
- Order history
- Gated technical document downloads

## Discover

1. Fetch Protected Resource Metadata:

```http
GET /.well-known/oauth-protected-resource HTTP/1.1
Host: www.avidorganics.net
```

2. Fetch Authorization Server Metadata:

```http
GET /.well-known/oauth-authorization-server HTTP/1.1
Host: www.avidorganics.net
```

## Authentication method

This service supports the **password** grant type (resource owner credentials). Registration exists (see "Agent registration" below) but requires a verified business email and a CAPTCHA, so it cannot be completed by an unattended agent.

### Obtain a token

```http
POST /api/oauth/token HTTP/1.1
Host: www.avidorganics.net
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=<email>&password=<password>
```

Response:

```json
{
  "access_token": "...",
  "token_type": "Bearer"
}
```

### Use the token

```http
GET /api/auth/me HTTP/1.1
Host: www.avidorganics.net
Authorization: Bearer <access_token>
```

## Agent registration

Customer accounts can be created via:

```http
POST /api/auth/register HTTP/1.1
Host: www.avidorganics.net
Content-Type: application/json

{"email": "...", "first_name": "...", "last_name": "...", "company_name": "...", "agree": true, "turnstileToken": "..."}
```

This endpoint requires a verified, non-disposable business email and a Cloudflare Turnstile CAPTCHA token, so it is **not** automatable by an unattended agent — it is the same endpoint the sign-up page at `https://www.avidorganics.net/en/signup` posts to. Do not call it during passive discovery scans. Employee access uses Microsoft SSO, not this endpoint.

## Errors

| Status | Meaning | Action |
|--------|---------|--------|
| 401 | Missing or invalid token | Re-authenticate or use public endpoints |
| 403 | Insufficient permissions | Use a different account or public endpoints |
| 429 | Rate limited | Back off and retry with exponential delay |

## Revocation

Sessions can be terminated via:

```http
POST /api/auth/logout HTTP/1.1
Host: www.avidorganics.net
```

## Contact

For API access questions: info@avidorganics.net