# Haddon Institute auth.md

This document describes how automated agents and integrations authenticate with **Haddon Institute** (Australian English public site).

## Audience

- **Agents and developers** calling public HTTP APIs (search, chat, forms).
- **Staff** accessing Leadership Intensive admin tools (Microsoft sign-in).

## Public APIs (no OAuth token)

Most advertised endpoints in [`/openapi.json`](https://haddoninstitute.org/openapi.json) are **anonymous** and **rate limited**. Send requests directly; respect `X-RateLimit-*` and `Retry-After` headers.

- Discovery: [`/.well-known/api-catalog`](https://haddoninstitute.org/.well-known/api-catalog)
- Overview: [`/developers`](https://haddoninstitute.org/developers)

<a id="anonymous-public-api"></a>
### Anonymous access

Use for site search (`GET /api/search`), health checks (`GET /api/health`), and chat (`POST /api/chat`) within published limits. Do not scrape staff admin routes.

<a id="agent-access"></a>
## Agent registration

Haddon Institute does **not** operate a self-service agent credential issuer. There is no `POST /agent/auth` registration endpoint.

For integration questions or higher rate limits, email [admin@haddoninstitute.org](mailto:admin@haddoninstitute.org) with your use case.

## Staff and protected routes

Staff sign-in uses **Better Auth** with **Microsoft Entra ID** at [`/api/auth`](https://haddoninstitute.org/api/auth). Session cookies apply to staff admin pages only; this is not a general-purpose OAuth token API for third-party agents.

OAuth discovery metadata:

- [`/.well-known/oauth-authorization-server`](https://haddoninstitute.org/.well-known/oauth-authorization-server)
- [`/.well-known/oauth-protected-resource`](https://haddoninstitute.org/.well-known/oauth-protected-resource)
- [`/.well-known/openid-configuration`](https://haddoninstitute.org/.well-known/openid-configuration)

## Related discovery

- ARD manifest: [`/.well-known/ai-catalog.json`](https://haddoninstitute.org/.well-known/ai-catalog.json)
- MCP server card: [`/.well-known/mcp/server-card.json`](https://haddoninstitute.org/.well-known/mcp/server-card.json)