# DDQ auth.md

## Audience

This document applies to agents and automated clients using DDQ's public information interfaces.

## Authentication status

No registration or authentication is required. DDQ's public agent is read-only and exposes only public company, service-status and contact information.

DDQ's private cloud services use Authelia as their identity provider. Its issuer is `https://auth.ddq.nl`; public OIDC discovery is available at `https://auth.ddq.nl/.well-known/openid-configuration`.

OAuth discovery for agents is also published at:

- Protected Resource Metadata: `https://ddq.nl/.well-known/oauth-protected-resource`
- Authorization Server Metadata: `https://ddq.nl/.well-known/oauth-authorization-server`

## Existing OAuth/OIDC flow

`auth.ddq.nl` is an operational Authelia authorization server. It supports:

- authorization code and PKCE for user-delegated access;
- client credentials for approved machine clients;
- device authorization where an interactive device flow is appropriate;
- refresh tokens;
- token introspection and revocation;
- signed-token verification through its public JWKS.

Bearer access tokens are presented in the HTTP `Authorization` header. OAuth clients, redirect URIs, allowed grants and scopes are provisioned by DDQ for the relevant private service.

## Public interfaces

- MCP endpoint: `https://ddq.nl/mcp/`
- MCP transport: Streamable HTTP
- Structured company record: `https://ddq.nl/api/company.json`
- Cloud service status: `https://ddq.nl/status.json`
- Agent card: `https://ddq.nl/.well-known/agent-card.json`
- MCP server card: `https://ddq.nl/.well-known/mcp/server-card.json`

## Registration and provisioning

Registration is not supported or necessary for the public interfaces. DDQ does not issue access tokens, API keys or agent credentials for public company information.

### Manual provisioning for private services

Private agent access is provisioned by DDQ under a customer or project agreement. Begin at `mailto:web@ddq.nl` with the intended resource, task, acting organisation, required scopes and responsible human contact. DDQ then determines whether an OAuth client, named user, service account or another bounded credential is appropriate.

There is deliberately no public `POST /agent/auth` endpoint. Passive scanners and agents must not attempt to create an account. Authelia does not currently advertise dynamic client registration, verified-email agent claims, anonymous credentials or ID-JAG registration. The OAuth metadata therefore does not contain a fabricated `agent_auth` flow.

## Credential use

Clients must not send credentials to the public interfaces. Requests to the MCP endpoint use `Content-Type: application/json` and follow the protocol described by the MCP server card.

## Scope

The interfaces are informational. They do not permit account access, purchases, data modification, infrastructure administration or autonomous submission of forms.

For access to a private DDQ or customer system, contact `web@ddq.nl`. Private access is provisioned under a separate agreement and is not discoverable through this public endpoint.

Authelia does not currently advertise a dynamic client-registration endpoint. Agent clients for private services therefore require manual provisioning by DDQ. The public MCP endpoint does not accept or require Authelia credentials.