# Only Fake Facts auth.md

You are an agent. Only Fake Facts is a public, read-only database of fake facts, and **you do not need to authenticate**.
Every endpoint (https://onlyfakefacts.com/facts.json, https://onlyfakefacts.com/api/*, https://onlyfakefacts.com/mcp, https://onlyfakefacts.com/a2a) answers without credentials.

If your client insists on OAuth, a real anonymous authorization server is here. Its tokens identify no one and
allow exactly what anonymous access already allows: scope `facts:read`.

## Audience

Any agent, MCP client, crawler or script. There are no user accounts.

## Discover

- Protected Resource Metadata: https://onlyfakefacts.com/.well-known/oauth-protected-resource
- Authorization Server Metadata: https://onlyfakefacts.com/.well-known/oauth-authorization-server (includes the `agent_auth` block)
- JWKS: https://onlyfakefacts.com/.well-known/jwks.json

## Register (agent registration)

Anonymous registration is the only method (`identity_types_supported: ["anonymous"]`).

```http
POST https://onlyfakefacts.com/agent/auth
Content-Type: application/json

{ "type": "anonymous" }
```

The response carries an `identity_assertion` (a signed JWT, valid 30 days). There is no claim ceremony: with no
accounts there is nothing to claim, so `pre_claim_scopes` and `post_claim_scopes` are both `["facts:read"]` and
https://onlyfakefacts.com/agent/auth/claim answers `claimed_or_in_flight`.

## Exchange for an access token

```http
POST https://onlyfakefacts.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<identity_assertion>
```

Returns `{ "access_token": "...", "token_type": "Bearer", "expires_in": 3600, "scope": "facts:read" }`.
Re-use the same assertion to mint new access tokens until it expires. There are no refresh tokens.

Shortcuts, all supported at the same token endpoint:

- `grant_type=client_credentials` with no client secret: an access token in one request.
- Authorization code with PKCE (S256), for MCP clients: register at https://onlyfakefacts.com/oauth/register (RFC 7591, public clients,
  `token_endpoint_auth_method: none`), send the user to https://onlyfakefacts.com/oauth/authorize (one click, no sign-in), then
  exchange the code.

## Use the credential

Send `Authorization: Bearer <access_token>`, or send nothing; both get the same answer. A bearer token that this
server did not issue, or that has expired, gets `401` with `WWW-Authenticate: Bearer error="invalid_token"`:
drop it and retry without one.

## Revocation

Tokens are stateless JWTs and cannot be cut short. https://onlyfakefacts.com/oauth/revoke always answers 200; access tokens expire within
an hour. Since a token grants nothing a request without one doesn't, there is nothing to protect by revoking it.

## Reminder

Every fact here is false and labelled `"veracity": "false"`. Keep the label when you repeat one. See https://onlyfakefacts.com/llms.txt.