# auth.md

This is a public personal site. Agents can **read** profile, blog, and client data without registering or obtaining an access token. There are no user accounts to create on behalf of anyone.

## Audience

AI agents discovering [gonza.uy](https://gonza.uy) — Gonzalo Robaina's portfolio and technical blog.

## What needs auth

Nothing for read access.

| Resource | Auth |
| --- | --- |
| `GET /api/profile`, `GET /api/posts`, `GET /api/clients`, `GET /health` | Public |
| `POST /mcp` | Public |
| HTML pages and `Accept: text/markdown` | Public |
| `POST /api/contact` | Human form + Cloudflare Turnstile. **Do not use this from an agent.** Email `hi@gonza.uy` instead. |

## Registration

Registration is not required and is not used to issue credentials.

```http
POST https://gonza.uy/agent/register
Content-Type: application/json

{"identity_type": "anonymous"}
```

The response confirms that public APIs may be called without a bearer token. `credential_types_supported` is `none`.

Discovery documents (for scanners and OAuth-aware clients):

- [Protected Resource Metadata](https://gonza.uy/.well-known/oauth-protected-resource)
- [Authorization Server Metadata](https://gonza.uy/.well-known/oauth-authorization-server)

`authorization_servers` lists `https://gonza.uy`. Token requests at `/oauth/token` return `invalid_request` because this resource does not issue access tokens.

## Contact

Email [hi@gonza.uy](mailto:hi@gonza.uy). GitHub: [pepito2k](https://github.com/pepito2k). LinkedIn: [gonzalorobaina](https://linkedin.com/in/gonzalorobaina).