# Ortuas - Agent Authentication

Ortuas is an AI receptionist platform for small businesses. Most of the public site
(marketing pages, pricing, integrations, blog, llms.txt) is readable without any
authentication. Only customer dashboard data requires an access token.

## Public, no authentication required

- `https://ortuas.com/llms.txt` - short site overview for AI agents
- `https://ortuas.com/llms-full.txt` - extended product and pricing content
- `https://ortuas.com/sitemap.xml` - full page index
- `https://ortuas.com/.well-known/api-catalog` - link catalog (RFC 9727)
- `https://ortuas.com/.well-known/agent-skills/index.json` - agent skills index

## Protected resources

Customer account data is protected. Discovery metadata:

- Protected resource metadata: `https://ortuas.com/.well-known/oauth-protected-resource`
- Authorization server metadata: `https://ortuas.com/.well-known/oauth-authorization-server`
- OpenID Connect discovery: `https://ortuas.com/.well-known/openid-configuration`

Tokens are issued by the Ortuas identity service at
`https://olefkfqmkvmvchyhpbiy.supabase.co/auth/v1`. Send them as
`Authorization: Bearer <access_token>`.

## Agent registration

Ortuas does not currently support automated, self-service agent registration.
An agent acting on behalf of a customer must use a token issued to that customer
after they sign in at `https://ortuas.com/auth`.

To request programmatic access for an agent, contact the Ortuas team through
`https://ortuas.com/book-demo` or the contact details listed on
`https://ortuas.com/about`. Access is granted per account with human review.

## Rate limits and use

- Respect `https://ortuas.com/robots.txt`, including the Content-Signal directives.
- Do not attempt to access `/admin`, `/dashboard`, or `/auth` paths as a crawler.
- Booking a demo is a human action. Agents should surface the booking link rather
  than submit the form on a person's behalf without explicit consent.