# Amistades auth.md

## Audience

This document is for agents acting on behalf of a human user who wants to discover public events or use an Amistades ticket or organizer account.

## Public agent access

Public pages, the event catalog, API documentation, and the public event API do not require an account:

- Event API: https://amistades.jp/api/events
- OpenAPI document: https://amistades.jp/openapi.json
- API catalog: https://amistades.jp/.well-known/api-catalog

## User-authorized access

Ticket-account and organizer endpoints require a bearer token issued by the configured Supabase authentication server. Buyers use human-controlled email magic links. Organizers may use a verified email/password account, password recovery, or a magic-link fallback. Agents cannot register themselves, request recovery or login links, or receive unattended credentials without the human user's explicit action and mailbox control.

- Protected resource metadata: https://amistades.jp/.well-known/oauth-protected-resource
- OpenID Connect discovery: https://amistades.jp/.well-known/openid-configuration
- OAuth authorization server metadata: https://amistades.jp/.well-known/oauth-authorization-server
- Interactive ticket access: https://amistades.jp/my-tickets
- Interactive organizer access: https://amistades.jp/organizer

Send bearer tokens only in the HTTP `Authorization` header and only to https://amistades.jp. Never place tokens in URLs, logs, prompts, or third-party tools.

For access or integration questions, contact info@amistades.jp.