# Auth.md

> Agent registration metadata for turva.dev.
> Public read-only. No accounts. Credentials are optional and
> only attribute correspondence.
> Operator contact: <mailto:info@turva.dev>.

## Agent registration

turva.dev publishes public read-only metadata for AI agents.
No endpoint requires a credential and there are no user accounts.
This domain does publish OAuth protected resource metadata at
/.well-known/oauth-protected-resource, which names an
authorization server, three scope names and bearer tokens in the
Authorization header. Read that document as discovery, not as
protection: every declared resource answers an anonymous request
exactly as it answers one carrying a token, and no scope grants
access that anonymous does not already have. It is published so
an OAuth-aware agent can discover the identity surface without
guessing, not because a 401 is waiting. The only credential this
domain issues is an optional api_key, provided out-of-band on
request; it attributes correspondence and grants no additional
access. This document describes how an operator can
register an agent identity, request metadata corrections, and
revoke prior correspondence.

## Identity

- Operator: Erik Rekola (sole proprietorship, Finland)
- Trade name: turva.dev
- Business ID: 3600281-7
- Register: https://tietopalvelu.ytj.fi/yritys/3600281-7
- Verified contact: <mailto:info@turva.dev>
- Public profile: https://www.linkedin.com/in/erikrekola/
- Source code: https://github.com/erekola

## Supported identity types

- anonymous: no registration, every resource is public read-only;
  an api_key can be issued out-of-band on request
- identity_assertion: a registered operator identity, backed by a
  verified email or a signed assertion; the same api_key applies

A credential only attributes correspondence. Every resource is
public, none requires a credential, and no credential grants
additional access.

## Registration

Registration is handled by email; https://turva.dev/agent/auth/register
returns the same pathway as JSON. Email <mailto:info@turva.dev?subject=agent%20registration> with:

- Agent identifier and software name
- Operator name and legal entity
- Purpose of access (research, integration, monitoring)
- Expected request rate (per hour) and concurrency
- Public contact for the operator

A written acknowledgement is sent within one business day.

## Claim

To claim an existing identifier, use https://turva.dev/agent/auth/claim
or email <mailto:info@turva.dev?subject=agent%20claim>. Include proof of
operator control (DNS TXT, signed message from a known code hosting
account, or a verified company email).

## Revocation

To revoke prior correspondence or request deletion of stored
metadata, use https://turva.dev/agent/auth/revoke
or email <mailto:info@turva.dev?subject=agent%20revocation>.
Records held to meet Finnish accounting obligations (invoices)
cannot be deleted until the statutory retention period ends.

## Engagement principles

- Async-only. No calls, no calendar links.
- First reply in writing within one business day.
- Production credentials are not requested.
- No tracking, no analytics, no third-party scripts on this site.

## Related discovery

- OAuth Authorization Server: https://turva.dev/.well-known/oauth-authorization-server
- OAuth Protected Resource: https://turva.dev/.well-known/oauth-protected-resource
- API catalog: https://turva.dev/.well-known/api-catalog
- Security contact: https://turva.dev/.well-known/security.txt
- Legal: https://turva.dev/legal