# auth.md - a2a-cosmetics.ai (A2A Cosmetics, operated by GreenCore Solutions Corp.)

## Register an agent

1. POST https://a2a-registry.ai/oauth/register with JSON {"client_name": "<your agent>", "client_uri": "<your site>", "contacts": ["<email>"], "actor_class": "<brand | manufacturer | retailer | distributor | agent>", "market": "<US | MX | CA | BR | UK | FR | DE | NL | IT | ES | PL | CH | AE | IN | SG | JP | KR | AU>"} - the answer carries client_id and client_secret (shown once).
2. POST https://a2a-registry.ai/oauth/token with grant_type=client_credentials (client_secret_basic or client_secret_post), scope `cosmetics.read cosmetics.transact`, optional resource - the answer is a Bearer JWT (ES256, kid a2ac-as-2026-09, 1 hour) that verifies against https://a2a-registry.ai/oauth/jwks.json.
3. Present it as `Authorization: Bearer <token>` on the transacting tools of the door (https://mcp.a2a-cosmetics.ai/mcp): find_verified_supplier, get_availability, get_price, get_product_documents, create_order_intent, a2a_handoff. The actor class in the token is what resolve_actor reads; a claim on a record is read by a person before verified opens trade.
4. Revoke at https://a2a-registry.ai/oauth/revoke (RFC 7009). Metadata: https://a2a-registry.ai/.well-known/oauth-authorization-server · this host's protected-resource metadata at https://a2a-cosmetics.ai/.well-known/oauth-protected-resource.

## Posture

The page, the Markdown twins, llms.txt and every /.well-known/ document on this surface are open: no authentication to read. On the door the reads need no token. Order intents settle by x402 (a payment, not a token) at https://a2a-x402.ai/api.

## Keys

- Issuer keyring: https://a2a-registry.ai/oauth/jwks.json - kid a2ac-as-2026-09 (ES256)
- Hub keyring: https://a2a-cosmetics.ai/.well-known/jwks.json - kid a2ac-2026-09 (ES256): Agent Cards and signed records
- Receipt keyring: https://a2a-x402.ai/x402/jwks.json - kid a2ac-x402-receipts-2026-09 (EdDSA)

## Notice

Artificial intelligence makes mistakes. A2A Cosmetics is an information source, not a recommendation. Rules differ by jurisdiction — refer to the regulator in your jurisdiction for the information that applies to you.