# Football Flocks auth.md

Football Flocks is a public static content site. Public league, competition, club, team, player, news, author, sitemap, and LLM guide resources do not require user authentication.

## Step 1 — Discover

Agents can discover the protected resource metadata at:

```http
GET https://footballflocks.com/.well-known/oauth-protected-resource
```

The protected resource metadata points to the authorization server metadata:

```http
GET https://footballflocks.com/.well-known/oauth-authorization-server
```

## Step 2 — Read agent_auth metadata

Football Flocks publishes `agent_auth` metadata for agent registration discovery, even though public content access does not require credentials.

```json
{
  "agent_auth": {
    "skill": "https://footballflocks.com/auth.md",
    "register_uri": "https://footballflocks.com/agent-auth",
    "claim_uri": "https://footballflocks.com/agent-auth-claim",
    "revocation_uri": "https://footballflocks.com/agent-auth-revoke",
    "identity_types_supported": ["anonymous"],
    "scopes_supported": ["public.read"]
  }
}
```

## Step 3 — Registration flow

No agent registration is required for `public.read` access. Agents may treat public pages, `robots.txt`, sitemap files, `llms.txt`, `llms-full.txt`, the API catalog, and well-known discovery files as anonymous read-only resources.

## Scopes

- `public.read`: read public Football Flocks pages and discovery files.

## Credential issuance

Football Flocks does not issue bearer tokens, API keys, or account-scoped credentials from this static site. The current `register_uri`, `claim_uri`, and `revocation_uri` return static JSON explaining that anonymous `public.read` access needs no credential.

## Contact

Use `https://footballflocks.com/contact-us/` for editorial or access questions.