# path-a-auth.md

You are an agent. Use this apex registration flow until the next intel serve.
Live `https://twzrd.xyz/auth.md` is proxied to intel image `d2fda619a` and still
registers on `GET /v1/intel/trust` at 0.05 USDC. That is the optional V7
credential mint, not the first paid hop.

First paid hop is `GET /v1/intel/quick/{seller_payTo}` at 0.001 USDC (score-only).
Optional portable V7 credential is `GET /v1/intel/trust/{seller_payTo}` at 0.05 USDC.
`claim_uri` stays `/trust` — that is where the signed receipt is minted.
Own-wallet smoke uses `GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs`. Real pays
put the seller payTo in the path. USDC still lands on GFpLvoc.

Follow the steps in order. Paid examples use `https://intel.twzrd.xyz`.

## Step 1 — Discover

Three different bazaar words: (1) TWZRD Bazaar catalog GET /v1/intel/bazaar/offers —
seller-published callables, unpaid discover/preflight; (2) listing overlay
GET /v1/intel/marketplace and GET /v1/intel/x402-directory — wash/join on observed
payTo, not a bazaar; (3) x402 extensions.bazaar on a 402 — routeTemplate metadata,
not the catalog.

Discovery is two hops. A paid endpoint answers an unpaid request with x402 v2
requirements in both the JSON body and the `payment-required` response header.

```http
GET https://intel.twzrd.xyz/.well-known/oauth-protected-resource
GET https://intel.twzrd.xyz/.well-known/oauth-authorization-server
```

`agent_auth.claim_uri` is `/v1/intel/trust/{seller_payTo}`. Do not treat that as
the first pay. First paid hop is `/quick` at 0.001 USDC.

## Step 2 — Pick a method

Anonymous only. A Solana wallet is the identity. No OAuth token exchange.

## Step 3 — First paid hop (anonymous)

1. Fund a Solana wallet with USDC. The per-request network fee can be sponsored
   (see the `feePayer` in the 402 challenge).
2. Call the first paid hop. The server answers `402` with a challenge:

```http
GET /v1/intel/quick/GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs

HTTP/1.1 402 Payment Required
payment-required: <base64-encoded x402 v2 PaymentRequired envelope>
```

3. Sign one accepted requirement and retry with `payment-signature`:

```http
GET /v1/intel/quick/GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs
payment-signature: <base64-encoded x402 v2 PaymentPayload>
```

4. Optional portable credential: repeat the same 402 cycle on
   `GET /v1/intel/trust/GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs` (0.05 USDC).
   The successful JSON includes `twzrd_receipt`. That is the V7 credential mint.

AgentCash status (2026-07-29): `npx agentcash@0.17.1 fetch ...` completed a full
paid-trust path (0.05 USDC → valid V7). That run is INTERNAL_INTEROP (payer
`4LkEFj…`), mechanical CLI proof only, not organic external demand.

## Step 4 — Use the credential

Verify offline against `GET https://intel.twzrd.xyz/.well-known/twzrd-receipt-pubkey`
or `POST https://intel.twzrd.xyz/v1/receipts/verify`. Sample first:
`GET https://twzrd.xyz/path-a-receipt-example.json`
(live intel `/v1/receipts/example` note still says pay `/trust` until serve).

## Endpoints by access tier

| Tier | Example | Auth Required |
|------|---------|---------------|
| Free | `POST /v1/intel/preflight` | None |
| Paid (first hop) | `GET /v1/intel/quick/GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs` | x402 0.001 USDC |
| Paid (optional V7) | `GET /v1/intel/trust/GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs` | x402 0.05 USDC |

## Prices

| Resource | Price (USDC) |
|----------|-------------|
| Score-only teaser (first hop) | 0.001 |
| Trust intel + signed receipt | 0.05 |

## Related

- Paste-bait: https://twzrd.xyz/QUICKSTART.md
- Skill: https://twzrd.xyz/path-a-skill.md
- Machine start: https://twzrd.xyz/llms.txt