# Authentication — Web Media University

Base URL: https://webmediauniversity.com

## Discovery

- Protected resource metadata: https://webmediauniversity.com/.well-known/oauth-protected-resource
- Authorization server metadata: https://webmediauniversity.com/.well-known/oauth-authorization-server
- OpenID Connect discovery: https://webmediauniversity.com/.well-known/openid-configuration
- API catalog: https://webmediauniversity.com/.well-known/api-catalog
- Capability manifest: https://webmediauniversity.com/.well-known/ai-catalog.json
- Agent skills: https://webmediauniversity.com/.well-known/agent-skills/index.json

## Identity model

Web Media University uses one account per person, with program entitlements attached to it.
Agents never get their own account: they act **on behalf of a signed-in member** using a
delegated OAuth 2.1 access token issued by the authorization server below.

Issuer: `https://dtqhyvdhopkpzctqxkcv.supabase.co/auth/v1`

- Flow: `authorization_code` with PKCE (`S256`)
- Token type: Bearer, sent as `Authorization: Bearer <token>`
- Refresh: `refresh_token` grant at the token endpoint
- Scopes: `openid`, `email`, `profile`

## Agent registration

There is no self-service agent registration, and accounts cannot be created without payment.

1. The person enrolls and pays for a program (https://webmediauniversity.com/programs), or staff provisions a seat.
2. They create their account from the post-checkout claim link, or accept a staff invitation.
3. The agent then runs the delegated authorization-code flow above and acts as that member.
4. For partner or platform integrations, request access at https://webmediauniversity.com/contact.

Registration and support: use the contact form at https://webmediauniversity.com/contact (email from the site is
sent from a no-reply address).

## Public, unauthenticated access

No token is required for content discovery:

- https://webmediauniversity.com/llms.txt — site guide
- https://webmediauniversity.com/api/public/rss.xml — published article feed
- https://webmediauniversity.com/sitemap.xml — indexable URLs
- https://webmediauniversity.com/api/public/health — service health
- https://webmediauniversity.com/openapi.json — machine-readable API description

## Revocation

Members can revoke agent access by signing out of all sessions from their account settings, or
by emailing the address above. Tokens also expire and must be refreshed.

## Content usage

See https://webmediauniversity.com/robots.txt for Content Signals declaring how this content may be used
(`ai-train=no`, `search=yes`, `ai-input=yes`).