# Auth.md

_Agent authentication & registration policy for CandiesWholesaler._

## Reading (catalog & content)
**No authentication is required.** All product, category, and content endpoints are public read:

- HTML pages: https://candieswholesaler.com/
- Markdown of any page: send `Accept: text/markdown`, or append `.md`
- Product data (JSON): https://candieswholesaler.com/wp-json/wc/store/v1/products (WooCommerce Store API, read-only, public)
- Site guide: https://candieswholesaler.com/llms.txt
- Agent instructions (when to use + how to read): https://candieswholesaler.com/llms-instructions.md
- Sitemap: https://candieswholesaler.com/sitemap_index.xml

## Ordering
Ordering is open to everyone — retail shoppers and wholesale buyers alike. Prices are public, and both guests and registered customers can place orders online. There is no automated, programmatic checkout or agentic-payment endpoint: the shopper pays by secure card at checkout, and the order is confirmed once payment goes through. There is no minimum order, and approved wholesale accounts add account pricing.

## Agent registration & credentials
- **Reading needs no registration or credentials** — every endpoint above is public read.
- **Authenticated API access:** the WordPress REST API (`/wp-json/`) accepts per-user **Application Passwords** (a WordPress-core credential type). An administrator issues one under *Users -> Profile -> Application Passwords* and sends it as HTTP Basic auth. No public self-service OAuth client registration is offered to third-party agents.
- **Customer / wholesale account registration:** buyers (human or agent) can register a customer account at https://candieswholesaler.com/my-account/ (WooCommerce). Wholesale pricing requires an approved wholesale account.
- **OAuth discovery:** an OAuth 2.0 authorization-server descriptor is published at https://candieswholesaler.com/.well-known/oauth-authorization-server (provided by the site's MCP integration).

## Descriptor
Machine-readable capability manifest: https://candieswholesaler.com/.well-known/ard.json