# auth.md Industries of India offers optional anonymous agent registration with expiring read-only credentials and an optional verified-email ownership claim. All public catalog endpoints remain available without authentication. Registration grants no publishing, purchasing, account administration, or private analytics access. ## Discover and register Resource: https://www.industriesofindia.com/api/ Supported method: anonymous. This is a simple opaque bearer-token registration protocol, not an OAuth authorization server. No ID-JAG, external identity assertions, or OAuth token exchange is supported. register_uri: https://www.industriesofindia.com/agent/register claim_uri: https://www.industriesofindia.com/agent/claim revocation_uri: https://www.industriesofindia.com/agent/revoke identity_types_supported: anonymous anonymous.credential_types_supported: bearer POST /agent/register with Content-Type: application/json and body {"type":"anonymous"}. The response contains registration_id, access_token, token_type Bearer, expires_in 86400, scope catalog.read, claim_token, a six-digit user_code and the supported endpoint URLs. Store access_token and claim_token securely. Tokens are issued once and expire 24 hours after registration, whether claimed or not. Register again after expiry; no refresh token is supported. ## Use a credential GET /agent/status with Authorization: Bearer to check registration, expiry and claimed status. Public reads at /api/industries and /api/books work without a token. An invalid, revoked or expired token at /agent/status returns 401. A token never grants write access. ## Optional verified-email claim Only initiate after the person agrees to link their name and email to this read-only registration. Show the claim_uri and user_code from registration to that person. They open the website link, enter their name and email explicitly, and select Send verification email. This POSTs /agent/claim with JSON {"claim_token":"","name":"","email":""}. No email is captured by merely visiting the site. The service sends a personalized verification email to that address. The person opens the private link in their email and enters the separate user_code supplied by the agent. Never ask them to forward the private email link to the agent. Email possession and the separately supplied agent code are both required. The email link expires in 15 minutes, with at most five confirmation attempts. Email link GET alone does not confirm anything. The name is used in that email only and is not stored in the registration database. After they confirm, GET /agent/status shows claimed: true. Claiming does not widen scopes or extend expiry. The same read-only token remains valid until original expiry or revocation. This is verified email ownership, not identity proof beyond control of that mailbox. ## Revoke POST /agent/revoke with Authorization: Bearer , Content-Type: application/json, and {} to revoke the registration. Revocation immediately invalidates the token and clears stored email. The verified owner can also reopen their private email link and choose Revoke. No provider-driven revocation events are supported. ## Limits and data Registration is limited to 10 per IP per hour and 200 per day. Claim mail is capped at one per email per hour, five per IP per hour, 80 per day and 2,400 per month, below the provider's Free allowance. No paid overflow or automatic upgrade is enabled by this implementation. Limit exhaustion returns 429; unavailable storage or email returns 503. A failed email request never verifies a claim. Do not retry 4xx unchanged; back off on 429/503. Check status no more often than once every 10 seconds while a person is confirming. Only secret hashes are stored. Claimant email is stored to bind verification and cleared on revocation. Expired registration rows are removed in bounded cleanup on later registrations; expiry is enforced immediately even before cleanup. Provider email logs may retain the recipient and message for its stated retention period. No marketing, contacts list, or inbound mailbox is configured.