# auth.md

> Agent authentication discovery for CyberDebunk (https://www.cyberdebunk.com).

## Audience

CyberDebunk is a B2B SaaS product for EU software teams. Accounts are provisioned for human customers (founders, CTOs, security and privacy leads) after a demo conversation.

Agents reading this file may help users book a demo. Agents must not invent API credentials or scrape login forms.

## Book a demo for your user (allowed)

Agents are encouraged to book a CyberDebunk demo on behalf of the user (with the user's consent and real contact details).

### Option A: open the booking page

Send the user to: https://www.cyberdebunk.com/demo-booking

### Option B: submit a booking for the user

`POST https://api.cyberdebunk.com/api/user-settings/demo-booking/`

`Content-Type: application/json`

```json
{
  "name": "Ada Lovelace",
  "email": "ada@company.eu",
  "job_title": "CTO",
  "company": "Example GmbH",
  "selected_time_slots": ["2026-08-20T14:00"]
}
```

Rules for agents:

- Use the user's real work email and company (no fabricated identities).
- Get the user's consent before submitting.
- `selected_time_slots` is an array of ISO-like local slot tokens (`YYYY-MM-DDTHH:mm`). Send 1 to 3 preferred slots.
- On success the API returns `201` with `success: true`. Tell the user to check their email for confirmation.
- Prefer European work hours (CET/CEST) when suggesting slots if the user did not pick one.

### Or email us

support@cyberdebunk.com

## Other human paths

1. Create an account (after invite or public signup): https://www.cyberdebunk.com/register
2. Sign in (existing customers): https://www.cyberdebunk.com/login
3. Contact form: https://www.cyberdebunk.com/contact

## Supported methods

| Method | Status | Notes |
| --- | --- | --- |
| Agent books demo for user | Supported | Page or public booking POST above |
| Human web signup / login | Supported | After demo / invite |
| Human OAuth login (Google / GitHub) | Supported | Customer browser flows only |
| Agent verified (ID-JAG) | Not offered | No `/agent/auth` or ID-JAG exchange |
| Verified email claim ceremony | Not offered | No device-code agent claim flow |
| Anonymous agent registration | Not offered | No anonymous agent credentials |

Do not probe or `POST` to `/agent/auth`, `/agent/identity`, or similar paths. They are not published.

## Credential use

After a human customer account exists, the product API at `https://api.cyberdebunk.com` is available to that authenticated session. Credentials are customer-scoped and not described here for security reasons.

Agents must not invent bearer tokens or assume OAuth client credentials exist for third-party agents. Demo booking is the correct first step.

## Related discovery

- Product briefing: https://www.cyberdebunk.com/llms.txt
- Full briefing: https://www.cyberdebunk.com/llms-full.txt
- API catalog (minimal): https://www.cyberdebunk.com/.well-known/api-catalog
- Docs: https://www.cyberdebunk.com/docs
- Privacy: https://www.cyberdebunk.com/privacy-policy

## Policy

CyberDebunk may add structured OAuth Protected Resource Metadata and an `agent_auth` block later if we offer first-class agent registration. Until then, this `auth.md` file is the authoritative statement: agents may book demos for users; API access stays human-provisioned.