# Agent Authentication — Litzki Systems SOVP

This document describes how autonomous agents authenticate to, and verify the
integrity of, the SOVP validation services operated by Litzki Systems LLC.
It describes the mechanisms that are actually in place — no OAuth authorization
server is operated, so none is advertised.

- Operator: Litzki Systems LLC
- Contact: support@litzki-systems.com
- Last updated: 2026-07-18

## Summary

| Surface | Authentication |
|---|---|
| `sovp_quickscan` (free) | None required |
| `sovp_fullvalidation` (paid) | Stripe payment token, passed as a request parameter |
| Agent identity (optional) | Web Bot Auth — RFC 9421 HTTP Message Signatures |
| Response integrity | Ed25519 detached signatures (`kid: sovp-signing-key-v1`) |

## Endpoints

The validation surface is reachable over both MCP and REST. All endpoints are
served over HTTPS only.

- MCP JSON-RPC endpoint: `https://litzki-systems.com/mcp`
- REST Quick Scan (no auth): `https://litzki-systems.com/api/quickscan`
- REST Full Validation (token): `https://litzki-systems.com/api/fullvalidation`
- OpenAPI specification: `https://litzki-systems.com/openapi.json`
- Ed25519 public key set (JWKS): `https://litzki-systems.com/.well-known/jwks.json`
- Web Bot Auth signatures directory: `https://litzki-systems.com/.well-known/http-message-signatures-directory`

## 1. Quick Scan — no authentication

`sovp_quickscan` (MCP) and `POST https://litzki-systems.com/api/quickscan` (REST)
require no credentials. Send a JSON body containing a `domain`:

```
POST https://litzki-systems.com/api/quickscan
Content-Type: application/json

{ "domain": "example.com" }
```

The MCP server manifest at `https://litzki-systems.com/.well-known/mcp.json`
correspondingly declares `authentication: { type: "none" }`.

## 2. Full Validation — payment token

`sovp_fullvalidation` (MCP) and `POST https://litzki-systems.com/api/fullvalidation`
(REST) require a Stripe payment token obtained from the checkout at
`https://litzki-systems.com/sovp-full-validator-pricing`. The token is supplied
as a request parameter (`payment_token`), not as a bearer credential:

```
POST https://litzki-systems.com/api/fullvalidation
Content-Type: application/json

{ "domain": "example.com", "payment_token": "<stripe-token>" }
```

The token authorises a single validation. It is not an OAuth access token and
is not accepted in an `Authorization` header.

## 3. Agent identity — Web Bot Auth (RFC 9421)

Agents that wish to present a verifiable identity may sign their requests using
HTTP Message Signatures per RFC 9421 (the Web Bot Auth profile). The signing
keys and their validity windows are published as a JWK set at
`https://litzki-systems.com/.well-known/http-message-signatures-directory`,
with `nbf`/`exp` on each key. Signing is **optional**: it establishes caller
identity but is not required to invoke the Quick Scan.

Litzki Systems does not operate an OAuth 2.0 authorization server, so there is no
`/.well-known/oauth-protected-resource` document and no `WWW-Authenticate`
challenge flow. Agent authentication here is signature-based, not token-based.

## 4. Response integrity — Ed25519

Full Validation results are returned as Ed25519-signed certificates. Verify the
detached signature against the public key set at
`https://litzki-systems.com/.well-known/jwks.json` using the key identified by
`kid: sovp-signing-key-v1`. Signature verification is the authoritative check
that a certificate was issued by Litzki Systems and has not been altered.

## Contact

Security and integration questions: support@litzki-systems.com
Responsible disclosure: `https://litzki-systems.com/.well-known/security.txt`