# Zaki SMMA auth.md

Welcome to the automated agent authentication and interaction specification for **Zaki SMMA**, Cape Town's premier performance marketing agency.

This document describes how autonomous AI agents (LLM agents, MCP tools, automated procurement systems, and AI crawlers) can discover capabilities, authenticate, and interact with Zaki SMMA programmatic services.

## Agent Audience & Permissions

Zaki SMMA allows autonomous agents to:
1. Retrieve agency service catalogs, case studies, deliverables, and pricing frameworks.
2. Submit qualified prospective client intake records, audit requests, and strategy call bookings.
3. Check status of webhook submissions and consult performance marketing knowledge bases.

## Discovery Metadata

- **OAuth Protected Resource Metadata (PRM):** `https://zakismma.co.za/.well-known/oauth-protected-resource` (RFC 9728)
- **OAuth Authorization Server Metadata:** `https://zakismma.co.za/.well-known/oauth-authorization-server` (RFC 8414)
- **Model Context Protocol (MCP) Server Card:** `https://zakismma.co.za/.well-known/mcp/server-card.json` (SEP-1649)
- **Agent Skills Discovery Index:** `https://zakismma.co.za/.well-known/agent-skills/index.json` (Cloudflare Agent Skills Discovery v0.2.0)
- **Agentic Resource Discovery (ARD):** `https://zakismma.co.za/.well-known/ai-catalog.json`
- **RFC 9727 API Catalog:** `https://zakismma.co.za/.well-known/api-catalog`
- **LLM Content Manifest:** `https://zakismma.co.za/llms.txt` and `https://zakismma.co.za/llms-full.txt`

## Authentication Methods Supported

### 1. Anonymous Read & Public Lead Submission (Default)
Autonomous agents can query public capabilities and submit lead inquiries without pre-shared API keys by utilizing anonymous client tokens or direct webhook transport.
- **Grant Type:** `anonymous` or `client_credentials`
- **Registration URI:** `https://zakismma.co.za/agent/auth`
- **Claim URI:** `https://zakismma.co.za/agent/claim`
- **Supported Credential Types:** `bearer_token`, `api_key`

### 2. Identity Assertion (ID-JAG / Verified Email)
Enterprise agents acting on behalf of verified partner organizations or clients:
- **Identity Types Supported:** `identity_assertion`, `verified_email`
- **Assertion Types:** `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
- **Credential Types:** `bearer_token`

## Supported Scopes

| Scope | Description |
| :--- | :--- |
| `read:services` | Access agency marketing service descriptions, deliverables, and case studies |
| `lead:submit` | Submit client intake forms, strategy audit requests, and booking payloads |
| `consultation:book` | Programmatically reserve a strategy consultation slot with the agency director |
| `agent:interact` | Invoke MCP tools or automated webhook endpoints |

## Bearer Token Usage

Include the token in HTTP request headers:
```http
Authorization: Bearer <your_access_token>
```

## Lead Submission Endpoint

Agents may submit qualified leads via JSON POST:
- **URL:** `https://script.google.com/macros/s/AKfycbzxsLrX1Kn6lFYMRsRMc1GreHpSIZHRmMrLYAtyasOvLOT3aYKYyi2TzX0vtfw6J9lB/exec`
- **HTTP Method:** `POST`
- **Content-Type:** `application/json`
- **Payload Schema:**
  ```json
  {
    "formType": "lead",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "phone": "+27 82 123 4567",
    "service": "meta-ads",
    "budget": "R20,000 - R50,000",
    "message": "Interested in scaling our DTC eCommerce store with paid social."
  }
  ```

## Contact & Human Escalation
- **Agency:** Zaki SMMA (Cape Town, South Africa)
- **Direct WhatsApp:** [+27 79 361 6654](https://wa.me/27793616654)
- **Email:** info@zakismma.co.za