# Workforce Infotech Agent Authentication

This service exposes public discovery resources and one protected read-only capability endpoint. Agents can register an OAuth client, obtain a short-lived bearer token with the `agent.read` scope, and call the protected endpoint. No payment, account access, personal records, or project submission is performed by this API.

## 1. Discover the protected resource

Fetch:

- Protected Resource Metadata: `https://workforceinfotech.com/.well-known/oauth-protected-resource`
- Authorization Server Metadata: `https://workforceinfotech.com/.well-known/oauth-authorization-server`

The supported OAuth grant is `client_credentials`. The supported scope is `agent.read`.

## 2. Register an agent client

Send a JSON POST request to `https://workforceinfotech.com/oauth/register`:

```json
{
  "client_name": "Your agent or integration name"
}
```

The response returns a `client_id` and `client_secret`. Store the secret securely. Do not expose it in browser code, public logs, prompts, or repositories.

## 3. Obtain an access token

Send a form-encoded POST request to `https://workforceinfotech.com/oauth/token` with HTTP Basic authentication using the registered client ID and secret:

```text
grant_type=client_credentials&scope=agent.read
```

The response contains a short-lived bearer token.

## 4. Call the protected resource

Send the token in the HTTP `Authorization` header:

```text
GET https://workforceinfotech.com/api/v1/private-capabilities
Authorization: Bearer YOUR_ACCESS_TOKEN
```

The endpoint is read-only and returns links to the public service catalog, project contact page, MCP server, and API documentation.

## 5. Revoke a token

POST the token to `https://workforceinfotech.com/oauth/revoke` and authenticate the client using HTTP Basic authentication:

```text
token=YOUR_ACCESS_TOKEN
```

## Security and use

- Never send credentials to any hostname other than `workforceinfotech.com` over HTTPS.
- Do not use the API to submit personal or confidential project data.
- Registration and token endpoints may apply rate limits.
- Use of the service is subject to the published Privacy Policy and Terms and Conditions.
- For private integrations, contact `info@workforceinfotech.com`.