# EXVIV auth.md

EXVIV supports accountless API access for automated agents and verified-email provisioning for human-operated workspaces. EXVIV does not advertise an OAuth authorization server or bearer-token API access.

## Discover

- Agent audience: autonomous agents and machine clients buying EXVIV competitive intelligence.
- Discovery: https://exviv.com/api/agent/v1/catalog
- OpenAPI: https://exviv.com/openapi.json
- Documentation: https://exviv.com/x402

## Pick a method

1. **Accountless x402:** for automated API buyers. No registration, OAuth client, API key, cookie, or workspace is required.
2. **Verified email:** for a person provisioning a private EXVIV workspace for human-operated use. This method creates a browser session, not an agent API bearer credential.

## Agent registration metadata

The following self-contained agent_auth block describes the real verified-email workspace provisioning flow. It is not OAuth metadata.

~~~yaml
agent_auth:
  skill: https://exviv.com/auth.md
  register_uri: https://exviv.com/api/auth/request-link
  claim_uri: https://exviv.com/auth/callback
  identity_types_supported:
    - identity_assertion
  identity_assertion:
    assertion_types_supported:
      - verified_email
    credential_types_supported:
      - browser_session
    claim_uri: https://exviv.com/auth/callback
~~~

## Register

Open https://exviv.com/login in a browser and submit a work email after accepting the Terms and acknowledging the Privacy Policy. The page calls POST https://exviv.com/api/auth/request-link with same-origin JSON and the x-exviv-request: login-link marker. Registration sends email and may create an account, so passive scanners and unattended agents must not POST to this endpoint.

## Claim

Open the one-time link delivered to the verified email address. The link claims the pending registration at https://exviv.com/auth/callback; it requires the matching browser intent cookie and expires after 15 minutes.

## Use the credential

Verified-email provisioning establishes a secure, HTTP-only browser session for EXVIV workspace pages. Do not use that session as an API bearer credential.

For accountless API access, call a paid endpoint without a payment credential to receive its PAYMENT-REQUIRED x402 v2 challenge. After applying the agent wallet's spend policy, retry the identical request with PAYMENT-SIGNATURE. Never send a wallet private key to EXVIV.

## Errors

- 400: invalid registration input or legal acceptance is missing.
- 403: the request is not a trusted same-origin login request.
- 503: verified-email provisioning is temporarily unavailable.
- Invalid or expired claim links return the user to the login page without creating a session.

## Revocation

A workspace user can revoke the current browser session with POST https://exviv.com/logout. Wallet authorization and x402 payment signatures are scoped to their exact payment requirements; EXVIV does not retain a wallet private key or issue a reusable agent credential.

## OAuth metadata

Because EXVIV does not offer OAuth for these flows, it does not publish OAuth Protected Resource Metadata or Authorization Server Metadata.