# auth.md — Penny Press

Penny Press (Scribed) has no user accounts, no logins, no API keys, and no
OAuth server. There is nothing to sign up for.

## Humans

Everything is free. Read full texts at `/read/{slug}`. No authentication
of any kind.

## Machines (agents)

Machine clients authorize with money, not identity: the x402
payment-required protocol.

1. `GET /essays/{slug}` with no payment returns HTTP 402 with a
   machine-readable x402 challenge (price, network, asset, recipient).
2. Pay the stated USDC amount on Base (`eip155:8453`) to the stated
   recipient wallet.
3. Retry the request with the payment signature to receive HTTP 200 and
   the content.

Current tiers: fragments $0.01, ensembles $0.02, prose $0.05. The live
catalog, prices, and recipient wallet are always in
`/.well-known/x402`.

## About the /.well-known/oauth-* files

They exist because agent-discovery checklists expect them. Penny Press
operates no OAuth authorization server, issues no tokens, and holds no
signing keys (see `/.well-known/jwks.json`). The endpoints named in that
metadata point at the x402 catalog, which is where machine authorization
actually happens here. Do not attempt an OAuth flow against this site —
pay per read instead.


## Agent registration

There is intentionally no registration flow here, and therefore no
`register_uri` to call and no `agent_auth` credential negotiation:
Penny Press keeps no accounts, issues no API keys, and provisions no
OAuth clients. The machine equivalent of registration is simply: read
`/.well-known/x402`, pay the stated price per request, and retry with
the payment proof. If a registration-based method is ever offered, its
endpoint and method will be documented in this file.