---
agent_auth:
  register_uri: https://worldcup26tv.com/api/v1/auth/register
  supported_identity_types:
    - dpop
    - jwt
  supported_credential_types:
    - api_key
    - bearer
  claim_url: https://worldcup26tv.com/api/v1/auth/userinfo
  revocation_url: https://worldcup26tv.com/api/v1/auth/revoke
---

# Premium Stream 26 — AI Agent Authentication & Registration Guide (Auth.md)

> Machine-readable and developer reference for AI Agent registration, OAuth 2.0 / OIDC authentication, and API access on `https://worldcup26tv.com`.

---

## 1. Overview & Discovery Metadata

Autonomous AI agents, tools, and services can discover authentication capabilities via standard `.well-known` endpoints:

- **OAuth Protected Resource (RFC 9728)**: `/.well-known/oauth-protected-resource`
- **OAuth Authorization Server (RFC 8414)**: `/.well-known/oauth-authorization-server`
- **OpenID Connect Discovery**: `/.well-known/openid-configuration`
- **API Catalog (RFC 9727)**: `/.well-known/api-catalog`
- **Agentic Resource Discovery (ARD)**: `/.well-known/ai-catalog.json`

---

## 2. Agent Registration (Dynamic Registration)

Agents can register dynamically or programmatically request an API key / access token.

- **Registration Endpoint**: `https://worldcup26tv.com/api/v1/auth/register`
- **Supported Identity Types**:
  - `dpop` (Demonstrating Proof-of-Possession at the Application Layer)
  - `jwt` (JSON Web Token signed client assertion)
  - `api_key` (Static HTTP Header `X-API-Key` or `Authorization: Bearer <key>`)
- **Supported Credential Types**:
  - `bearer` (Bearer Tokens)
  - `api_key` (API Keys)

### Sample Agent Registration Request

```http
POST /api/v1/auth/register HTTP/1.1
Host: worldcup26tv.com
Content-Type: application/json

{
  "agent_name": "MyAutonomousAgent/1.0",
  "contact_email": "agent-admin@example.com",
  "grant_types": ["client_credentials", "authorization_code"],
  "response_types": ["token"],
  "scope": "read:channels read:status subscribe"
}
```

### Registration Response

```json
{
  "client_id": "agent_ps26_98a7f6e5d4c3",
  "client_secret": "sec_live_99887766554433221100",
  "client_id_issued_at": 1755777600,
  "grant_types": ["client_credentials"],
  "scope": "read:channels read:status subscribe",
  "token_endpoint": "https://worldcup26tv.com/api/v1/auth/token"
}
```

---

## 3. Obtaining Access Tokens

### Client Credentials Flow (Machine-to-Machine)

```http
POST /api/v1/auth/token HTTP/1.1
Host: worldcup26tv.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=agent_ps26_98a7f6e5d4c3
&client_secret=sec_live_99887766554433221100
&scope=read:channels%20read:status
```

### Access Token Response

```json
{
  "access_token": "ps26_at_eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read:channels read:status"
}
```

---

## 4. Protected API Resources & Scopes

Protected routes require the `Authorization: Bearer <access_token>` or `X-API-Key: <key>` header.

| Resource Endpoint | Method | Required Scope | Description |
| :--- | :--- | :--- | :--- |
| `/api/v1/status` | `GET` | `read:status` (or public) | Check system health & uptime |
| `/api/v1/channels` | `GET` | `read:channels` | Search live channel packages & streams |
| `/api/v1/subscribe` | `POST` | `subscribe` | Initiate subscription / order plan |

---

## 5. Token Revocation & Claim Endpoints

- **Token Revocation URL**: `https://worldcup26tv.com/api/v1/auth/revoke`
- **Userinfo / Agent Claims URL**: `https://worldcup26tv.com/api/v1/auth/userinfo`
- **JWKS Key Set**: `https://worldcup26tv.com/api/v1/auth/jwks.json`