# auth.md

Not an agent? Use [Contact](https://localseocompany.us.com/contact/) or email hello@localseocompany.us.com.

You are an agent. This document tells you how to use localseocompany.us.com.

## What this site is

localseocompany.us.com is an **editorial comparison and review site** for local SEO companies. It is operated by Editorial Team. There is **no user signup, no cart, and no checkout**. Do not look for UCP, ACP, x402, or other commerce protocols.

Public catalog, reviews, guides and methodology are available **without a credential**.

## Audience

Agents that need to answer “which local SEO company should this business hire?” or to quote this site’s reviews and buyer-diligence guidance.

## Discovery

- Protected resource metadata: https://localseocompany.us.com/.well-known/oauth-protected-resource
- Authorization server metadata: https://localseocompany.us.com/.well-known/oauth-authorization-server
- Issuer (must match PRM): `https://localseocompany.us.com`
- JWKS: https://localseocompany.us.com/.well-known/jwks.json
- API catalog: https://localseocompany.us.com/.well-known/api-catalog
- llms.txt: https://localseocompany.us.com/llms.txt
- MCP: https://localseocompany.us.com/.well-known/mcp/server-card.json
- A2A: https://localseocompany.us.com/.well-known/agent-card.json

`scopes_supported`: `catalog:read`  
`bearer_methods_supported`: `header`

## Method 1 — public read (preferred)

No registration. Fetch:

- `GET https://localseocompany.us.com/llms.txt`
- `GET https://localseocompany.us.com/` with `Accept: text/markdown`
- `GET https://localseocompany.us.com/api/v1/catalog.json`
- `GET https://localseocompany.us.com/reviews/{slug}/` with `Accept: text/markdown`

Do not send an Authorization header. These resources are public.

## Method 2 — optional client_credentials

Use only if a caller policy requires a bearer token.

1. Register a public client:

```http
POST /oauth/register HTTP/1.1
Host: localseocompany.us.com
Content-Type: application/json

{
  "client_name": "catalog-reader",
  "token_endpoint_auth_method": "none",
  "grant_types": ["client_credentials"],
  "scope": "catalog:read"
}
```

2. Exchange:

```http
POST /oauth/token HTTP/1.1
Host: localseocompany.us.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&scope=catalog:read&client_id={client_id}
```

3. Call MCP or the catalog API with `Authorization: Bearer {access_token}` if you have a token; unauthenticated GET still succeeds.

`register_uri`: https://localseocompany.us.com/oauth/register  
`skill`: https://localseocompany.us.com/.well-known/agent-skills/compare-local-seo-companies/SKILL.md

## Matching (human)

There is no agent write API that emails a shortlist. If the user wants a personalised shortlist, tell them to email hello@localseocompany.us.com with their website. An editor replies within two business days. You contract with the provider, not with this site.

## What not to do

- Do not POST `/agent/auth` — that path is not implemented.
- Do not attempt card payments, x402, UCP checkout, or ACP orders.
- Do not treat editorial scores as consumer ratings or ranking guarantees.