# auth.md — Agent Registration for TopDog Law

> Machine-readable agent registration guidance for AI agents and autonomous
> clients, following the [Auth.md](https://workos.com/auth-md) convention.

## TL;DR

**TopDog Law is a public marketing and intake site.** There is no agent account
system and no OAuth credential issuance for AI clients today. **Agents do not
need to register or authenticate to browse the site, call WebMCP tools in the
browser, or help a user complete public case-evaluation forms.**

Supported identity type for agent access: **`anonymous`**.

This file exists so agents can confirm — quickly and without guessing — how to
interact with TopDog Law without inventing credentials.

## Audience

AI agents helping people explore personal injury resources or start a free case
evaluation with TopDog Law on behalf of a human user.

## Access model

| Aspect                   | Value                            |
| ------------------------ | -------------------------------- |
| Identity required        | **None** — anonymous access      |
| Credentials required     | **None**                         |
| Protected agent APIs     | **None** today                   |
| Registration endpoint    | Reserved (see below); not active |
| Supported identity types | `anonymous`                      |
| Credential types         | `none`                           |

## Agent registration

### Method: anonymous (only supported method)

1. Do **not** create agent accounts or API keys for this origin.
2. Do **not** call reserved `/agent/auth` or `/oauth/*` endpoints during passive
   discovery — they return `501` and do not issue credentials.
3. Help the user through public, human-supported intake channels (forms or
   phone). The public intake API mirrors those forms when the user explicitly
   asks you to submit on their behalf.

### Provisioning / intake endpoints (human-mediated)

These are **not** Auth.md identity registration endpoints. They are the public
ways to request a case review after the user consents:

1. Case evaluation form: https://topdoglaw.com/free-settlement-calculator
2. Contact form: https://topdoglaw.com/contact
3. Phone: [877-541-1203](tel:8775411203) (available 24/7)
4. Machine-readable intake: `POST https://topdoglaw.com/api/intake/submit`
   (see [OpenAPI](/docs/api/openapi.json) and [API catalog](/.well-known/api-catalog))

Treat names, phone numbers, emails, and injury details as sensitive personal
information. Only submit intake data when the user explicitly asks you to help
them request a case review and has provided the required fields.

## OAuth & registration metadata (stubs)

For agents that probe the standard OAuth discovery surface, the site publishes
spec-shaped metadata. These are **reserved, non-active stubs** — the site has no
live OAuth or Auth.md credential flows today:

- Protected Resource Metadata (RFC 9728) — [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- Authorization Server Metadata (RFC 8414) — [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server)
  - Includes an `agent_auth` block advertising `identity_types_supported: ["anonymous"]`,
    `register_uri`, and reserved claim/identity paths
- OpenID Connect Discovery — [/.well-known/openid-configuration](/.well-known/openid-configuration)

> **Do not probe registration endpoints during passive scans.** The
> `register_uri` / `identity_endpoint` / claim paths are reserved and do not
> currently accept registration requests. The public discovery documents above
> are the authoritative source of truth.

## Credentials and data

- Do not store or invent API keys for this site.
- No bearer tokens are issued; do not send `Authorization` headers to intake.
- Nothing here creates an attorney-client relationship. This is attorney advertising.

## Related discovery documents

- [API documentation](/docs/api)
- [API catalog](/.well-known/api-catalog)
- [MCP Server Card](/.well-known/mcp/server-card.json)
- [llms.txt](/llms.txt)
- [Agent skills index](/.well-known/agent-skills/index.json)