# Auth.md

Prestige Hampers supports agent discovery and registration through this document. Agents should follow these steps in order: discover metadata, register or identify the user, create an API session, call the API, and handle revocation.

## Step 1 - Discover

Fetch Protected Resource Metadata from `https://www.prestigehampers.co.uk/.well-known/oauth-protected-resource`, then fetch Authorization Server Metadata from `https://www.prestigehampers.co.uk/.well-known/oauth-authorization-server`. The authorization server response contains the `agent_auth` block with registration details.

## Step 2 - Pick a Method

Supported identity types are `anonymous` and `identity_assertion`. For identity assertions, this service currently advertises `verified_email`. Supported credential types are `x-session-id` and `session-cookie`.

## Step 3 - Register

Use `https://www.prestigehampers.co.uk/register` for customer account registration. For partner or API access requests, use `https://www.prestigehampers.co.uk/contact-us` and include the agent name, operator, intended API use, and requested scopes.

## Step 4 - Create an API Session

Create a session with `GET https://www.prestigehampers.co.uk/api/v1/config`. Send the returned session ID in the `X-Session-ID` header for API requests that require session state. The API catalog is available at `https://www.prestigehampers.co.uk/.well-known/api-catalog` and API documentation is available at `https://www.prestigehampers.co.uk/docs/api`.

## Step 5 - Use the Credential

Call API endpoints under `https://www.prestigehampers.co.uk/api/v1` with the `X-Session-ID` header. If a request returns `401` or the session is no longer valid, discard the credential and restart discovery from Step 1.

## Revocation

Users can manage or revoke account access from `https://www.prestigehampers.co.uk/my-account`. Partner/API access revocation should be requested through `https://www.prestigehampers.co.uk/contact-us`.