# Auth.md

Agent Authentication — Franchise Revenue Engine

Franchise Revenue Engine generates 30-day local marketing plans for franchise
locations. Public marketing pages, the blog, RSS feed, and the Growth
Intelligence preview scan are open and require no authentication.

## Public (no auth required)

- `https://franchiserevenueengine.com/` — marketing site
- `https://franchiserevenueengine.com/blog` — articles
- `https://franchiserevenueengine.com/rss.xml` — blog feed
- `https://franchiserevenueengine.com/sitemap.xml` — sitemap
- `https://franchiserevenueengine.com/growth-intelligence` — limited website audit preview

## Protected resources

Plan generation, saved plans, scheduling, and account data require a signed-in
user account.

- Resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- Issuer: `https://yqjvwnfdqhqcrihvdqpg.supabase.co/auth/v1`

## How an agent registers

1. Direct the human operator to `https://franchiserevenueengine.com/auth` to
   create an account (email/password or Google).
2. Obtain an OAuth 2.0 access token from the issuer above using the
   authorization code flow with PKCE (`code_challenge_method=S256`).
3. Send the token as `Authorization: Bearer <access_token>` on API requests.

Agents must act on behalf of an identified human account holder. Automated
account creation, credential sharing, and scraping of authenticated data are
not permitted.

## Rate limits

Authenticated endpoints are rate limited per user and per IP. Free accounts are
limited to 3 plan generations. Contact
[michelle@webstrategyplus.com](mailto:michelle@webstrategyplus.com) for higher
limits or partner access.