# auth.md - Shadow Streak Agent Access

Welcome to **Shadow Streak**, a platform for Shadowverse Worlds Beyond deck analytics, card querying, and statistics.

## Current Authentication

Programmatic agent registration, OAuth bearer tokens, and machine-to-machine credentials are not currently available.

Interactive users can sign in with Google through the browser. The application then uses an HTTP-only cookie session with the backend. This browser flow is not an OAuth service for third-party agents.

## Anonymous Agent Access

Agents may access public pages and public read-only data without registering. Account-specific and write-oriented paths are excluded from crawler access in `/robots.txt`.

Useful resources:

- Home page Markdown: `/index.md`
- API catalog: `/.well-known/api-catalog`
- Card library: `/library`
- Deck statistics: `/statistics`
- Community forum: `/forum-list`

Clients must not treat browser cookies as reusable agent credentials or attempt to automate the Google login flow.

## Content Usage Policy

The site declares the following Content Signals policy:

```text
ai-train=no, search=yes, ai-input=no
```

Search indexing is allowed. AI training and use as input to generative AI systems are not permitted.

## Planned Agent Authentication

OAuth Protected Resource Metadata and Auth.md agent registration metadata will be published only after the backend supports bearer-token validation, scoped authorization, credential issuance, and revocation.

DNS for AI Discovery also remains pending until Shadow Streak has a custom domain, a real agent index endpoint, SVCB-capable DNS hosting, and a DNSSEC-signed zone.

This document will be updated when those capabilities are operational.