# auth.md — gtinfetch.ai (GreenCore Solutions Corp.)

## Posture

gtinfetch.ai is the resolver — the who, what, where of GTINs for agentic commerce. The GTIN fact checker for AI agents: any barcode, one call, the page under it. 84M GTINs, retail grocery.

The door is **open by design**: GET https://gtinfetch.ai/01/{gtin14} and the MCP door https://gtinfetch.ai/mcp take no authentication and no bearer token; every machine file under /.well-known/ is public. x402 at the door — USDC and Open USD on Base. Pay inside the call. The 402 body carries the terms; receipts resolve at https://gtinfetch.ai/x402/receipt/{nonce} and verify against https://gtinfetch.ai/.well-known/jwks.json.

## Protected resource

- Resource: https://gtinfetch.ai
- Protected Resource Metadata: [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- Authorization server (Microsoft Entra, the GSC estate's): https://login.microsoftonline.com/54939635-2f2e-465a-8526-a907cb3c8ebd/v2.0
- AS metadata mirror: [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server)
- Bearer tokens, where a GSC surface takes them, are presented in the Authorization header. This door takes none.

## Agent registration (self-contained flow)

- **Agent audience:** AI agents and operators calling gtinfetch (MCP, https://gtinfetch.ai/mcp) and the GSC hubs' gated tools.
- **Registration endpoint:** https://gsc-navigator.ai/ — GSC Navigator, the Human-in-the-Loop inbound (POST https://formspree.io/f/xaqrznpe with fields name, email, message). There is no self-serve dynamic client registration; every registration is human-reviewed.
- **Supported method — verified email:** GSC verifies the operator's email, then provisions credentials after review.
- **Credential use:** GSC issues **Microsoft Entra OAuth 2.0 client credentials** (client_credentials grant against the issuer above) for the surfaces that take them; present the access token as a **Bearer token in the Authorization header**. Revocation on request via the same endpoint.

```json
{
  "agent_auth": {
    "skill": "https://gtinfetch.ai/auth.md",
    "register_uri": "https://gsc-navigator.ai/",
    "identity_types_supported": [
      "identity_assertion"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "verified_email"
      ],
      "credential_types_supported": [
        "oauth2_client_credentials"
      ]
    },
    "claim_uri": "https://gsc-navigator.ai/"
  }
}
```

Operator: GreenCore Solutions Corp. · D-U-N-S 24-336-6774 · Microsoft AI Cloud Partner.