# auth.md

Agent registration and authentication guide for **FamilyMed** (https://www.familymedicalhistory.app).

## Audience

FamilyMed is a private family medical record app. Agents may discover public
marketing pages and auth entry points. Agents must **not** access, scrape, or
infer individual health records.

## Human registration

1. Create an account at https://www.familymedicalhistory.app/register (email + password) or
   continue with Google OAuth from https://www.familymedicalhistory.app/login.
2. After sign-in, sessions are cookie-based (Supabase Auth via `@supabase/ssr`).
3. Password reset: https://www.familymedicalhistory.app/forgot-password.

## Agent authentication

There is **no** public machine OAuth client for PHI APIs. Discovery documents:

| Document | URL |
| --- | --- |
| OAuth Protected Resource Metadata | https://www.familymedicalhistory.app/.well-known/oauth-protected-resource |
| OAuth Authorization Server Metadata | https://www.familymedicalhistory.app/.well-known/oauth-authorization-server |
| OpenID Configuration | https://www.familymedicalhistory.app/.well-known/openid-configuration |
| API catalog | https://www.familymedicalhistory.app/.well-known/api-catalog |

The Authorization Server metadata includes an `agent_auth` block:

- `skill`: https://www.familymedicalhistory.app/auth.md
- `register_uri`: https://www.familymedicalhistory.app/register
- `identity_types_supported`: `anonymous`, `identity_assertion`
- Anonymous method: email/password signup via `claim_uri` = register
- Identity assertion method: verified email / OIDC (Google) via login;
  credentials are session cookies (no machine OAuth client for PHI)

## Credentials

- Browser sessions use HTTP-only cookies after successful login.
- Do not store or request medical export payloads for agent training.
- Prefer `Accept: text/markdown` on public pages for a readable summary.

## Related

- Privacy: https://www.familymedicalhistory.app/privacy
- Terms: https://www.familymedicalhistory.app/terms
- MCP server card: https://www.familymedicalhistory.app/.well-known/mcp/server-card.json
- A2A agent card: https://www.familymedicalhistory.app/.well-known/agent-card.json