Agent auth readiness

Why it matters

Agents need a documented way to obtain credentials with permissions suited to the task. Self-serve scoped API keys or delegated OAuth with discovery metadata and PKCE can provide that path. Documentation does not verify that authentication succeeds.

How to fix it

Document a scoped API-key flow or an OAuth flow with discovery metadata and PKCE S256.

1. For API keys, explain where to create a key without manual approval and name the available scopes. For OAuth, publish the authorization server and protected resource metadata.

2. Explain what each scope permits. For OAuth, list scopes_supported and include S256 in code_challenge_methods_supported.

3. Publish /auth.md with the credential setup, narrowest usable scope and an authenticated request example for the supported flow.

   # Authentication for agents
   
   Create an API key in the [dashboard](https://example.com/settings/api-keys) without manual approval.
   
   ## Scopes
   - `catalog:read`: Read the catalog. Select this scope for catalog queries.
   
   Send the key in the Authorization header as a bearer token.
   
   Example: `curl -H "Authorization: Bearer $API_KEY" https://example.com/api/catalog`

Verify

Run a new scan for this checkpoint: