# TENEO Agent Auth

TENEO Auth is the identity, delegation, scope, credit, and revocation control plane for the TENEO ecosystem.

This file is the public agent-auth entrypoint for agents that want to use TENEO systems on behalf of a user.

## Status

- Discovery: live
- User-claimed registration: live for service_auth
- Agent-verified ID-JAG registration: planned after trusted provider verification
- Public internal-Lambda MCP access: not supported

TENEO supports OAuth 2.0, scoped TENEO JWTs, token introspection, revocation, Nostr agent identity, unified credits, and the service_auth agent registration flow. Provider-verified identity assertions are still planned.

## Discovery

- Protected Resource Metadata: https://auth.teneo.io/.well-known/oauth-protected-resource
- Authorization Server Metadata: https://auth.teneo.io/.well-known/oauth-authorization-server
- OpenID Configuration: https://auth.teneo.io/.well-known/openid_configuration
- Token endpoint: https://auth.teneo.io/api/oauth/token
- Revoke endpoint: https://auth.teneo.io/api/oauth/revoke
- Introspection endpoint: https://auth.teneo.io/api/oauth/introspect

## Agent Registration

TENEO will start with a user-claimed service_auth flow:

1. The agent requests delegated access for a user and product resource.
2. TENEO Auth returns a user code and verification URL.
3. The user signs in to TENEO Auth and confirms the code, scopes, product, and credit-spend authority.
4. The agent exchanges the completed claim for a scoped access token.
5. The agent calls the target TENEO product API.

Agent-verified identity assertions will be added later after TENEO maintains a trusted provider list, JWKS verification, replay protection, and first-link step-up.

## Product Resources

### TENEO Production

- Resource: https://teneo.io/
- Purpose: publish-ready book generation and publishing workflows
- Agent capability path: https://teneo.io/api/agent/capabilities
- Primary scopes: books.capabilities.read, books.quote, books.generate, books.status, books.assets.read, credits.read, credits.spend

TENEO Production has an internal/developer MCP gateway for AWS Lambda operations. That gateway is not a public outside-agent capability. Outside agents should use the product agent API once delegated by TENEO Auth.

### ConversOS

- Purpose: conversational missions and first-party assistant workflows
- Expected model: use TENEO Auth delegation when acting for a user; use service credentials only for trusted backend-to-backend calls

### ArxMint

- Purpose: root identity graph, aliases, wallet and payment rails
- Expected model: scoped TENEO Auth tokens for user/agent identity operations; explicit wallet scopes and budget controls for payment operations

### LLM Scope

- Purpose: trace, evaluation, and trust-stack observability
- Expected model: separate write-only telemetry agents from read-capable agents

## Scope Catalog

- identity.read
- profile.read
- credits.read
- credits.spend
- books.capabilities.read
- books.quote
- books.generate
- books.status
- books.assets.read
- nostr.identity.read
- nostr.wallet.read
- nostr.wallet.invoice
- nostr.wallet.pay

Spend scopes such as credits.spend and nostr.wallet.pay require explicit user approval and should be bounded by product policy or delegation limits.

## Current Token Validation

First-party TENEO systems should validate tokens through introspection:

https://auth.teneo.io/api/oauth/introspect

Asymmetric signing and public JWKS for agent OAuth assertions are planned for broader third-party interoperability.

## Integration Contact

For agent-auth integration issues, contact support@teneo.io.