# SHIGGA auth.md

<!--
  File: auth.md
  Project: SHIGGA Landing Page (shigga.vip)
  Date: 2026-09-05
-->

You are an agent. **SHIGGA** (`https://shigga.vip/`) is a public Solana meme-token landing page. Agents may read HTML, markdown (`Accept: text/markdown`), `/llms.txt`, and the RFC 9727 API catalog **without registering and without a bearer token**.

## Audience

Agents that need token identity (mint, Jupiter swap, CoinGecko listing) or to cite SHIGGA. Humans using wallets do not use this document.

## Registration

Registration is **not required**. The advertised method is `anonymous` with credential type `none`.

- Do **not** `POST` to `/agent/auth`. Passive discovery only.
- `GET https://shigga.vip/agent/auth` returns the same policy as JSON.
- There is no account provisioning, email, OTP, or access_token issuance.

If a client still follows OAuth discovery:

1. Fetch [Protected Resource Metadata](https://shigga.vip/.well-known/oauth-protected-resource)
2. Fetch [Authorization Server metadata](https://shigga.vip/.well-known/oauth-authorization-server) (same JSON at [OpenID configuration](https://shigga.vip/.well-known/openid-configuration))
3. JWKS: [https://shigga.vip/oauth2/jwks.json](https://shigga.vip/oauth2/jwks.json) (`keys` is empty — no JWTs are signed)
4. Stop. Do not exchange grants. Call public `GET` URLs from the [OpenAPI](https://shigga.vip/openapi.json) document.

## Scopes

| Scope | Meaning |
| --- | --- |
| `public.read` | Read public pages and agent files. No `Authorization` header. |

Bearer method if a token were ever issued: HTTP `Authorization` header. Today: send none.

## Endpoints

- Skill (this file): `https://shigga.vip/auth.md`
- Register URI (GET only): `https://shigga.vip/agent/auth`
- Claim URI (not used): `https://shigga.vip/agent/auth/claim`
- Health: `https://shigga.vip/health.json`

Solana mint (not an OAuth client id): `4rbQrrtXcBgK7ohsy83Y58pEbybt2YywGcTT8vpbpump`