# auth.md

> Agent authentication and registration policy for **https://www.51domino.com**.
> Last updated: 2026-09-11 · Contact: aiqng@163.com

## 1. Summary

51domino is an enterprise AI deployment vendor (on-premise LLM platforms,
AI agents, AIGC, API gateway). All content, search and discovery endpoints on
this site are **public and require no credentials**. One capability is protected:
the bulk article-export tool of the MCP server, which needs an OAuth 2.0 access
token carrying the scope `content:export`.

This origin runs its own small authorization server (anonymous agents only — it
has no user accounts and never sees a human identity):

| Document | URL |
| --- | --- |
| Protected Resource Metadata (RFC 9728) | `/.well-known/oauth-protected-resource` |
| Authorization Server Metadata (RFC 8414) | `/.well-known/oauth-authorization-server` |
| Public key set (JWKS) | `/oauth/jwks.json` |
| Protected resource | `https://www.51domino.com/mcp` |

Unauthenticated calls to protected tools return a tool error plus a
`WWW-Authenticate: Bearer resource_metadata="..."` header on the HTTP response.

## 2. Public endpoints (no authentication)

| Endpoint | Method | Notes |
| --- | --- | --- |
| `/` , `/blog`, `/blog/{slug}`, `/solutions/{slug}`, `/products/*` | GET | HTML; also available as `text/markdown` via `Accept: text/markdown` |
| `/api/search?q=` | GET | Read-only article search, JSON |
| `/api/tweets` | GET | Read-only cached industry feed, JSON |
| `/mcp` | POST | MCP Streamable HTTP (JSON-RPC 2.0), read-only tools |
| `/.well-known/*` | GET | Discovery documents |
| `/health` | GET | Status probe |
| `/llms.txt`, `/llms-full.txt`, `/sitemap.xml` | GET | Plain text / XML |
| `/api/contact` | POST | Write endpoint: project enquiry intake, no credentials needed, rate limited to 1 request / minute / IP |

## 3. Registration for agents

Registration is **self-service and anonymous** — call the RFC 7591 dynamic client
registration endpoint; no human contact, account or email verification required:

```bash
curl -s -X POST https://www.51domino.com/oauth/register   -H 'Content-Type: application/json'   -d '{"client_name":"my-agent","grant_types":["client_credentials"],"scope":"content:export"}'
# → {"client_id":"51d-…","client_secret":"…","scope":"content:export", …}
```

Then mint an access token (RS256 JWT, 1 hour lifetime) and call the protected tool:

```bash
curl -s -X POST https://www.51domino.com/oauth/token   -d 'grant_type=client_credentials&client_id=…&client_secret=…&scope=content:export'
# → {"access_token":"eyJ…","token_type":"Bearer","expires_in":3600,"scope":"content:export"}

curl -s https://www.51domino.com/mcp -H 'Authorization: Bearer eyJ…'   -H 'Content-Type: application/json'   -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"export_article_index","arguments":{"limit":100}}}'
```

| Item | Value |
| --- | --- |
| Identity types supported | `anonymous` (no user identity, no email verification) |
| Credential types | `client_secret`, `bearer_token` |
| Registration URI | `https://www.51domino.com/oauth/register` |
| Token URI | `https://www.51domino.com/oauth/token` |
| Revocation URI | `https://www.51domino.com/oauth/revoke` |
| Claim URI | `https://www.51domino.com/oauth/claim` |
| Grant types | `client_credentials`; `authorization_code` with PKCE S256 and a consent screen |
| Scopes | `articles:read` (public read tools), `content:export` (protected bulk export) |

Agents that need **higher rate limits, commercial data licensing or write access
beyond `/api/contact`** still have to talk to a human: email
**aiqng@163.com** or WeChat `aiqng001` with the operator identity, the
endpoints you need and the expected volume. That part is not self-service.

## 4. Rules for agents

- Identify yourself with a descriptive `User-Agent` (e.g. `MyAgent/1.0 (+https://example.com/agent)`).
- Respect the crawl rules and content preferences in [/robots.txt](/robots.txt)
  (`Content-Signal: ai-train=yes, search=yes, ai-input=yes` — content may be
  used for search, indexing, and AI answers with attribution to 51domino).
- Read-only endpoints are free to use; keep request rates reasonable
  (≤ 1 req/s) and cache discovery documents.
- Do not attempt to submit `POST /api/contact` on behalf of a third party
  without their consent.

## 5. Feedback

Discovery or protocol issues (MCP, ARD, api-catalog, markdown negotiation) can be
sent to aiqng@163.com. See also [/docs/api](/docs/api) and
[/.well-known/ai-catalog.json](/.well-known/ai-catalog.json).