# auth.md - Stakao Agent Authentication and Payment

Stakao exposes public discovery and catalog endpoints for agents. Paid allocation recommendations use x402 USDC over HTTP.

## Public endpoints
- Site: https://stakao.com
- llms.txt: https://stakao.com/llms.txt
- API catalog: https://stakao.com/.well-known/api-catalog
- Agent manifest: https://api.stakao.com/agent
- OpenAPI: https://api.stakao.com/agent/openapi.json
- Agent catalog: https://api.stakao.com/agent/recommendations/catalog
- Public content search API: https://api.stakao.com/agent/search
- Product MCP server: https://api.stakao.com/agent/mcp
- Public content search MCP server: https://stakao.search.ai.cloudflare.com/mcp
- Human one-shot wallet precheck: https://api.stakao.com/allocation-analysis/precheck

## Paid endpoint
POST https://api.stakao.com/agent/recommendations/allocation

The paid endpoint returns HTTP 402 Payment Required when no valid x402 payment proof is supplied. Agents should read the payment requirements, pay in USDC, then retry the same request with the x402 payment header.

## V1 payment rail
- Protocol: x402
- Token: USDC
- Test network: Base Sepolia
- Production network: Base
- Current test price: $0.20

## OAuth status
Stakao does not publish OAuth for public paid recommendations in V1 because no account-bound action is required. OAuth will be added only for account-bound actions such as reading a user's saved wallets, reading their strategy history, or requesting an activation with explicit human consent.

## Agent registration
Agents can use Stakao public endpoints without registering an OAuth client in V1.

- Public discovery method: anonymous HTTPS discovery
- Paid recommendation method: x402 USDC payment
- Supported identity type today: anonymous buyer wallet
- Supported credential type today: x402 payment proof
- Registration endpoint: none required for public V1 agent recommendations
- Future account-bound registration: OAuth 2.0 / OIDC for explicit user-consented actions only

## OAuth discovery documents
- OAuth authorization server metadata: https://stakao.com/.well-known/oauth-authorization-server
- OpenID Connect metadata: https://stakao.com/.well-known/openid-configuration
- OAuth protected resource metadata: https://stakao.com/.well-known/oauth-protected-resource

## MCP status
The Stakao product MCP is public and read-only in V1. It does not require login, does not expose user account data, and does not create paid recommendations directly. Paid recommendations use the x402 HTTP endpoint above.

The Cloudflare AI Search MCP is separate and only searches public Stakao website content.

## Safety boundary
The agent API is recommendation-only. It creates an audited recommendation record with `agent_decisions.status = RECOMMENDED`. It never activates a strategy, creates delegate transactions, signs on-chain operations, or changes a user's existing Stakao subscription.

## Human one-shot
The human one-shot wallet allocation report costs €2.90 through Stripe Checkout. A user only enters a wallet address; no wallet connection is required. The backend checks the wallet has at least 3 TAO before Checkout is created.