# auth.md: how an agent gets access to DropZoom

DropZoom access is issued by a human, once, and used by an agent from then on. There is no
self-registration for agents, no OAuth, and no OpenID Connect. Do not look for an OAuth
authorisation server, an OpenID Connect discovery document, or a dynamic client registration
endpoint. None exist.

## 1. A human registers

A human registers at https://publish.dropzoom.link/ with a username, a passphrase and a human
check. No invitation, email or operator step is required. Registration issues one Recovery /
agent key, shown once on screen. It is not emailed and cannot be shown again, so it must be
saved straight into a password manager or secret store.

Some installations of DropZoom are invitation-only instead. The operator sends a private,
one-use invitation; the human accepts it in the browser, then creates a Recovery / agent key
from the dashboard. An agent can also accept an invitation directly with
`./dropzoom connect --invite-file PRIVATE_FILE`.

## 2. The human gives the agent the key

The agent receives the Recovery / agent key from the human through a secret store, never typed
into a prompt or chat. It then connects either by running:

```
./dropzoom connect --api https://publish.dropzoom.link --key-file /private/dropzoom-key
```

or by setting `EDGE_PUBLISH_API` and `EDGE_PUBLISH_KEY` from the secret store and skipping
`connect` entirely. Every API request after that carries `Authorization: Bearer <key>`.

## Revoking access

- Key self-management is for self-registered accounts only. A self-registered account owner can
  see every key, including when each was last used, and remove any of them except the account's
  primary sign-in key, from a browser signed in with their username and passphrase, at Account,
  Connected agents and devices. Removal takes effect immediately and signs out any browser session
  using that key.
- Signing in with a recovery or agent key instead of the passphrase can still publish, but cannot
  see, remove or create keys, so a stolen key cannot be used to lock the real owner out.
- The same screen can create another key (Account, then Create a key), up to 10 active keys per
  account. Creating a key does not revoke any earlier key, so it does not cut off an agent that
  already holds one.
- An account set up by invitation cannot manage its own keys at all, not even from the invitation
  key itself or an agent holding it: ask the operator through https://publish.dropzoom.link/contact
  to add or remove a key.
- The operator can also revoke any single key through https://publish.dropzoom.link/contact, and
  can suspend an invited publisher. Suspension revokes all of that publisher's keys, signs out
  their browsers and blocks their published links.

An agent cannot manage keys itself: a bearer key alone, or a browser session opened with anything
other than a self-registered account's own passphrase, is refused.

## Guest links are not for agents

A human can also try DropZoom without an account: drop a file at
https://publish.dropzoom.link/, pass a human check, and get a link that expires in 24 hours.
That path exists for people trying the product, is gated by a human check, and is not a way for
an agent to get API access.

## Related

- Agent skill file: https://dropzoom.link/dropzoom-skill.md
- Agent instructions: https://publish.dropzoom.link/llms.txt
- API catalog: https://dropzoom.link/.well-known/api-catalog
- Terms: https://dropzoom.link/terms
- Acceptable use: https://dropzoom.link/acceptable-use