# auth.md

## Service

spaced.school is the static landing site of SPACED — a Kazakhstan-based
online school for grades 5–11. It serves public HTML pages and a small set of
machine-readable resources for AI agents. There are no user accounts and no
protected APIs on this domain.

## Authentication

**None required.** All content is publicly readable over HTTPS without
credentials.

The only API associated with this site is a public analytics proxy:

- `POST https://amwwtwlsuwcgmfvubrye.supabase.co/functions/v1/meta-capi` —
  a Meta Conversions API proxy called from visitors' browsers. It accepts
  unauthenticated requests by design (no JWT, no API key, CORS `*`).
  Documentation: <https://spaced.school/docs/api.html>.
  Agents should not send synthetic events to it — every accepted event is
  forwarded to Meta as a real conversion signal.

## Agent access

- **Audience:** any AI agent, crawler, or automated client.
- **Registration:** none required. No agent registration or provisioning
  endpoint exists on this domain.
- **Supported method:** anonymous access only.
- **Credentials:** none are issued or accepted. Do not send `Authorization`
  headers; they are ignored.

## OAuth / OIDC metadata

- `/.well-known/oauth-protected-resource` — **published** (RFC 9728). It
  describes this origin as a fully public resource: `authorization_servers`
  and `scopes_supported` are empty by design, and `authorization_required`
  is `false`. An agent reading it should conclude that no token is needed,
  not that metadata is missing.
- `/.well-known/oauth-authorization-server` — **intentionally absent**
  (RFC 8414). This domain is not an OAuth authorization server: it issues no
  tokens, registers no clients, and exposes no `/authorize` or `/token`
  endpoint. Publishing that document here would be false metadata.
- `/.well-known/openid-configuration` — **intentionally absent** for the same
  reason. There is no OpenID Provider on this domain.

There is also no `agent_auth` registration block, because no agent
registration, credential issuance, or revocation endpoint exists.

If protected APIs are ever added, this file and the metadata above will be
updated accordingly.

## Discovery resources

- <https://spaced.school/llms.txt> — concise facts for LLMs
- <https://spaced.school/llms-full.txt> — full reference
- <https://spaced.school/for-llm/> — structured facts page
- <https://spaced.school/.well-known/api-catalog> — RFC 9727 API catalog
- <https://spaced.school/.well-known/oauth-protected-resource> — RFC 9728 PRM
- <https://spaced.school/docs/api.html> — API documentation

## Contact

Questions about this site or agent access:

- Phone: +7 700 641 80 01
- WhatsApp: <https://api.whatsapp.com/send/?phone=77009983632>
- Instagram: [@spaced.school](https://www.instagram.com/spaced.school/)
- Main site: <https://spaced.school>