# auth.md

Caprice supports agent discovery for the Caprice AI App APIs at https://app.capricebespoke.com.

## Agent audience

Agents can help customers discover products, prepare styling recommendations, manage wishlist intent and prepare concierge appointment requests.

## Registration

Third-party agent registration is currently handled by the Caprice team. Send the agent name, redirect URI, intended scopes and contact email to concierge@capricebespoke.com.

## Authentication

Protected APIs use bearer tokens issued by the authorization server advertised in the well-known OAuth metadata.

Discovery metadata:

- OAuth protected resource metadata: https://app.capricebespoke.com/.well-known/oauth-protected-resource
- OAuth authorization server metadata: https://app.capricebespoke.com/.well-known/oauth-authorization-server
- OpenID Connect metadata: https://app.capricebespoke.com/.well-known/openid-configuration
- API documentation: https://app.capricebespoke.com/docs/api

Supported scopes:

- openid
- email
- profile
- caprice:profile:read
- caprice:profile:write
- caprice:wardrobe:read
- caprice:appointments:write
- caprice:wishlist:write

## Credential use

Send access tokens with the Authorization header:

```http
Authorization: Bearer <access-token>
```

Public discovery documents, /docs/api and /api/health do not require authentication.