# auth.md

The Moorish Times supports agentic registration. Agents read the magazine with no account at all; registering only unlocks one action, sending a message to the newsroom (a story tip, a correction, a rights or advertising request) on a user's behalf.

- Resource server: https://mcp.moorish.cloud (the newsroom inbox, `POST /newsroom`)
- Authorization server: https://moorishtimes.com (metadata), with endpoints on https://mcp.moorish.cloud

The Moorish Times has no user accounts, so the only registration method is anonymous, and there is no claim ceremony.

## 1. Discover

Fetch the site's Protected Resource Metadata. The inbox's own copy, with the same issuer and scope, is named in `WWW-Authenticate: Bearer resource_metadata="..."` on a 401 from `POST /newsroom`.

```http
GET https://moorishtimes.com/.well-known/oauth-protected-resource
```

Read `authorization_servers` (https://moorishtimes.com), `scopes_supported` (`newsroom:send`) and `bearer_methods_supported` (`header`). Then fetch the Authorization Server metadata:

```http
GET https://moorishtimes.com/.well-known/oauth-authorization-server
```

- `token_endpoint`: https://mcp.moorish.cloud/oauth2/token
- `revocation_endpoint`: https://mcp.moorish.cloud/oauth2/revoke
- `grant_types_supported`: `urn:ietf:params:oauth:grant-type:jwt-bearer`
- `agent_auth.identity_endpoint`: https://mcp.moorish.cloud/agent/identity
- `agent_auth.identity_types_supported`: `anonymous`
- `agent_auth.identity_assertion.assertion_types_supported`: none, so identity assertions from your provider are not accepted
- `agent_auth.claim_endpoint` and `events_endpoint`: absent (no accounts to claim, no provider events)

## 2. Pick a method

Always `anonymous`. `identity_assertion` answers `identity_assertion_not_enabled` and `service_auth` answers `service_auth_not_enabled`. Send no personal data to register.

## 3. Register

```http
POST https://mcp.moorish.cloud/agent/identity
Content-Type: application/json

{"type": "anonymous"}
```

```json
{
  "identity_assertion": "eyJ...",
  "assertion_expires": "2026-11-02T08:00:00.000Z",
  "scopes": ["newsroom:send"]
}
```

The assertion lasts 24 hours. Five registrations a minute per network address.

## 4. Exchange the assertion

```http
POST https://mcp.moorish.cloud/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJ...
```

```json
{"access_token": "eyJ...", "token_type": "Bearer", "expires_in": 900, "scope": "newsroom:send"}
```

No refresh token: when the access token expires, exchange the same assertion again; when the assertion expires, register again.

## 5. Use the access token

```http
POST https://mcp.moorish.cloud/newsroom
Authorization: Bearer eyJ...
Content-Type: application/json

{"kind": "correction", "message": "The date in the second paragraph should be 1963.", "page": "https://moorishtimes.com/articles/guerre-des-sables", "reply_to": "reader@example.com", "language": "en"}
```

```json
{"id": "msg_...", "status": "received"}
```

- `kind` (required): `story`, `correction`, `rights`, `ads` or `other`
- `message` (required): up to 5000 characters, in French or English, in the user's words
- `reply_to` (optional): the user's email, only if they want an answer
- `page` (optional): the moorishtimes.com page it concerns
- `language` (optional): `fr` or `en`

Send only with the user's consent. Three messages an hour per registration, and the inbox accepts a fixed number a day.

The same action is the `send_to_newsroom` tool on the MCP server (https://mcp.moorish.cloud/mcp). Send the access token there as a Bearer header; without one, the tool allows one message a minute per network address.

## 6. Errors

| Code | Endpoint | What to do |
| --- | --- | --- |
| `invalid_request` | /agent/identity, /oauth2/token | Fix the body as shown above |
| `identity_assertion_not_enabled`, `service_auth_not_enabled` | /agent/identity | Register as `anonymous` |
| `slow_down` (429) | /agent/identity | Wait 60 seconds |
| `unsupported_grant_type` | /oauth2/token | Use `urn:ietf:params:oauth:grant-type:jwt-bearer` |
| `invalid_grant` | /oauth2/token | The assertion expired or was revoked: register again |
| `invalid_token` (401) | /newsroom | Exchange the assertion for a new access token |
| 400 with `error` | /newsroom | Fix the field it names |
| 429 with `error` | /newsroom | Wait an hour, or use https://moorishtimes.com/contact |

## 7. Revocation

```http
POST https://mcp.moorish.cloud/oauth2/revoke
Content-Type: application/x-www-form-urlencoded

token=eyJ...
```

Revoking an access token ends that token. Revoking the identity assertion ends the registration and every access token issued from it. The answer is 200 either way (RFC 7009). The Moorish Times may revoke a registration that sends spam.

## Reading needs none of this

Search and read without any token: MCP server https://mcp.moorish.cloud/mcp (card at https://moorishtimes.com/.well-known/mcp/server-card.json), A2A https://mcp.moorish.cloud/a2a, JSON API listed at https://moorishtimes.com/.well-known/api-catalog, and `Accept: text/markdown` on any article or news page. Personal agents find all of it in https://moorishtimes.com/.well-known/poppy.json (Personal Agent Protocol 0.3), and report a task they could not do to https://mcp.moorish.cloud/feedback. Contact: info@moorishtimes.com.

## Our own agent

The Moorish Times News Desk is the newsroom's fact-checking agent. Three times a day it reads official sources (ministries, agencies, courts, companies) one page at a time to verify the figures in news briefs before they run on moorishtimes.com. It does not crawl, collect data in bulk or use pages for training.

- User agent: `MoorishTimesNewsDesk/1.0 (https://moorishtimes.com; contact info@moorishtimes.com)`
- Signed with Web Bot Auth (RFC 9421, Ed25519). Requests carry `Signature-Agent: "https://moorishtimes.com"` and sign `@authority` and `signature-agent`, valid for five minutes.
- Public key directory: https://moorishtimes.com/.well-known/http-message-signatures-directory
- Volume is low: it fetches only the pages it needs to check a brief. To report a problem or ask it to stop, write to info@moorishtimes.com.