# Suliit — Agent authentication

Suliit is a U.S.-based multi-vendor marketplace operated from Prince Frederick,
Maryland. This document describes how autonomous agents and integrating
applications can register, authenticate, and act on behalf of a Suliit account.

## Contact

- Operator: Suliit
- Address: 151 Main St, Prince Frederick, MD 20678, United States
- Email: support@suliit.com
- Phone: +1 (410) 538-6059

## Discovery endpoints

- OAuth Protected Resource: `/.well-known/oauth-protected-resource`
- OAuth Authorization Server: `/.well-known/oauth-authorization-server`
- OpenID Connect: `/.well-known/openid-configuration`
- API catalog: `/.well-known/api-catalog`
- MCP server card: `/.well-known/mcp/server-card.json`
- Agent skills index: `/.well-known/agent-skills/index.json`

## Registering an agent

To register an autonomous agent for Suliit, contact `support@suliit.com` with:

1. The legal entity or individual operating the agent.
2. A description of the agent, its purpose, and the actions it will perform.
3. A contact address for abuse and security notifications.
4. Preferred credential type (`oauth2` or `api_key`).

After review, Suliit issues either an OAuth 2.1 client (with client_id,
optional client_secret, and redirect URIs) or a scoped API key.

## Identity and credential types

- Identities: `human`, `agent`
- Credentials: `oauth2` (Authorization Code + PKCE), `api_key`
- Token binding: bearer, sent in the `Authorization` header

## Scopes

- `read:catalog` — read public categories and listings.
- `read:listings` — read public storefront and listing details.

Write scopes for orders and account operations are issued case by case and are
documented at credential issuance time.

## Revocation and claims

- Revocation and dispute contact: `https://www.suliit.com/contact.html`
- Report abuse: `support@suliit.com`

Agents must comply with the Suliit Community Guidelines and Terms of Service.