# auth.md — Hotel Bergsonne Allgäu

Authentication and agent-registration instructions for automated clients of
Hotel Bergsonne Allgäu (Sonne Imberg GmbH), Imberg 12, 87527 Sonthofen, Germany.

## Audience

This document is for autonomous agents and AI clients that want to read hotel data,
check live availability and rates, or create reservations on behalf of a human user.

## Public access — no registration required

All read operations are open. No token, key, account or registration is needed.

- MCP endpoint: `https://bergsonne-allgaeu.de/api/booking-mcp`
- Transport: `streamable-http` (JSON-RPC 2.0 over HTTP POST)
- Server card: `https://bergsonne-allgaeu.de/.well-known/mcp.json`
- OpenAPI: `https://bergsonne-allgaeu.de/api/openapi`

Open tools: `get_hotel_details`, `get_fact_sheet`, `search_availability`.

```http
POST /api/booking-mcp HTTP/1.1
Host: bergsonne-allgaeu.de
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"tools/call",
 "params":{"name":"get_hotel_details","arguments":{}}}
```

## Authenticated access — reservation writes

Creating or modifying reservations uses OAuth 2.0 Authorization Code with PKCE (S256).

- Protected resource: `https://bergsonne-allgaeu.de/api/booking`
- Protected resource metadata: `https://bergsonne-allgaeu.de/.well-known/oauth-protected-resource`
- Authorization server metadata: `https://bergsonne-allgaeu.de/.well-known/oauth-authorization-server`
- Scopes: `hotel:read`, `booking:read`, `booking:write`
- Credential use: present the access token as `Authorization: Bearer <token>` on every
  request to `/api/booking`. Header method only. Tokens are short-lived; refresh with the
  `refresh_token` grant.

## Agent registration

Agents may self-register for an anonymous credential without human involvement.

- Registration endpoint: `POST https://bergsonne-allgaeu.de/agent/auth`
- Method: anonymous — no account, no email, no human approval
- Result: a bearer credential scoped to `hotel:read` and `booking:read`
- Write scope (`booking:write`) still requires the OAuth user flow above, because a
  reservation is made on behalf of a named human guest.

```json
{
  "agent_auth": {
    "skill": "hotel-booking",
    "register_uri": "https://bergsonne-allgaeu.de/agent/auth",
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["bearer"],
      "claim_uri": "https://bergsonne-allgaeu.de/agent/auth/claim"
    },
    "scopes_supported": ["hotel:read", "booking:read"],
    "authorization_servers": ["https://bergsonne-allgaeu.de"]
  }
}
```

## Agent identity

Discoverable via DNS-AID (DNSSEC-signed):

- `_a2a._agents.bergsonne-allgaeu.de` (SVCB, `alpn=a2a`)
- `_mcp._agents.bergsonne-allgaeu.de` (SVCB, `alpn=mcp`)
- `_index._agents.bergsonne-allgaeu.de` (SVCB)
- `_agent.bergsonne-allgaeu.de` (TXT, AID v2)

Outbound requests from this site's own bots are signed per Web Bot Auth. Verification keys:
`https://bergsonne-allgaeu.de/.well-known/http-message-signatures-directory`

## Contact

servus@bergsonne-allgaeu.de