# Auth.md

Delx Commerce does **not** use buyer accounts, API keys, or OAuth for paid
x402 product calls. Payment is the authorization for that single request.

## Agent authentication model

| Surface | Auth mode | Notes |
| --- | --- | --- |
| Paid x402 routes on `api.delx.ai` | HTTP 402 + USDC (Base) | No registration. Pay the challenge. |
| Free discovery (this host + portfolio/OpenAPI) | Public | No credentials. |
| Delx Protocol recovery MCP/A2A | Public / session tokens as documented | Separate product from Commerce. |

## How agents pay

1. Discover: `https://commerce.delx.ai/discovery.json` or `https://api.delx.ai/openapi.x402.json`
2. Call unpaid → receive HTTP **402** with `payment-required` / x402 body
3. Settle with a wallet (AgentCash, CDP, etc.) on **Base** USDC
4. Retry with payment proof headers

## Protected resource metadata

- Commerce: `https://commerce.delx.ai/.well-known/oauth-protected-resource`
- Protocol API: `https://api.delx.ai/.well-known/oauth-protected-resource` (when advertised)

Most Commerce endpoints are **payment-gated, not OAuth-gated**. OAuth protected
resource documents describe public discovery scopes only.

## Registration

There is no agent registration for the public x402 catalog. Agents that need
long-lived identity for Protocol recovery use Delx Protocol docs:

- `https://delx.ai/llms.txt`
- `https://api.delx.ai/.well-known/mcp/server-card.json`