# Conduit auth.md

This registration profile is for agents acting for an approved Conduit team member. Public endpoints in the [API catalog](https://condu.it/.well-known/api-catalog) remain anonymous and do not require registration.

## Registration and provisioning

Conduit uses operator-approved provisioning. Send a registration request to [contact@condu.it](mailto:contact@condu.it) from the Google Workspace identity the agent will represent. Include the agent name, operator, intended API operations, and requested scopes. Conduit does not support anonymous or automatic account creation.

The registration endpoint is `mailto:contact@condu.it`. Approval adds the Google Workspace identity to Conduit's role map; it does not issue a Conduit password, client secret, or refresh token.

## Supported identity and credential method

The supported identity type is a Google OpenID Connect identity assertion. After approval, obtain a Google ID token for the configured Conduit OAuth client with the `openid email profile` scopes. The token must contain the approved email and use `https://accounts.google.com` as its issuer.

Use the ID token as a bearer credential:

```http
Authorization: Bearer GOOGLE_ID_TOKEN
```

Conduit verifies the token signature, issuer, audience, expiry, and email before applying its local role policy. Browser sessions remain available for interactive users, but agents should use the bearer method. Access is revoked by removing the identity from the Conduit role map; request revocation through [contact@condu.it](mailto:contact@condu.it).

Discovery metadata is published at [OAuth Protected Resource Metadata](https://condu.it/.well-known/oauth-protected-resource), [Conduit agent authorization metadata](https://condu.it/.well-known/oauth-authorization-server), and [OpenID Provider Metadata](https://condu.it/.well-known/openid-configuration). The Conduit authorization document is a resource-specific discovery facade over Google's issuer and endpoints; Conduit does not mint OAuth tokens.