--- public_api: identity_types_supported: ["anonymous"] registration_required: false registration_endpoint: null mcp: authentication: oauth2 registration_required: true registration_endpoint: https://urhdqypgqdrywmncbnlg.supabase.co/auth/v1/oauth/clients/register protected_resource_metadata: https://aiready.nz/.well-known/oauth-protected-resource --- # AIready auth.md ## Audience For AI agents ordering reports on behalf of a buyer, and agent browsers using the free scanner. ## Authentication Supported access model: anonymous public access. Authentication method: none for the free scan and public report-ordering endpoint. No account, API key, bearer token or OAuth is required for these public services. Do not send credentials. ## Agent Registration Registration required: no. Agent registration is not required or available for these public services. Registration endpoint: none. There is no registration URL, credential issuance, API key or OAuth client to create. A delivery email is not verified identity, and an order ID or payment memo is not an access credential. ## Provisioning Flow Provisioning here means creating a pending report order, not registering an agent identity or granting account access. Public ordering endpoint: https://aiready.nz/api/public/agent/order. Method: POST. Content-Type: application/json. Required fields: product, domain and email. Optional field: competitors (up to five domains). ### Step 1: Choose the public service - Free scan: browse https://aiready.nz/scan as an ordinary signed-out visitor and submit the website domain in the scan form. - Order format: GET https://aiready.nz/api/public/agent/order returns public usage instructions. - Paid reports: choose agentic-readiness-check (12 USDC, NZ$19, automatic on-chain confirmation), agentic-readiness-check-test (1 USDC, NZ$1, for integration testing), competitor-check (120 USDC) or deep-scan (240 USDC). Obtain the buyer's approval before creating an order or making a payment. ### Step 2: Provision a pending report order POST application/json to https://aiready.nz/api/public/agent/order with product, domain and email. Use a bare website hostname, without a URL scheme or path. The email is the report delivery address, not proof of identity. You may include a competitors array containing up to five domain strings. Example (creates a real pending order; replace the example details with the buyer's approved details): ```bash curl --request POST 'https://aiready.nz/api/public/agent/order' \ --header 'Content-Type: application/json' \ --data '{"product":"competitor-check","domain":"example.co.nz","email":"buyer@example.com"}' ``` No Authorization header is needed. Never include a password, private key or access token. ### Step 3: Read the response before taking action - HTTP 402: a pending order was created, not paid. Save order_id and the payment object's amount, recipient, token_mint, memo and url. Every order also includes stripe_payment_url, a Stripe-hosted card checkout bound to that order, for a human to pay in NZ$ (valid 24 hours). Agentic Readiness Check orders also include card_checkout_url. After paying, poll the status endpoint. The payment URL is a Solana Pay transfer request, not an authentication or registration URL. - HTTP 400: the request was not accepted; correct the JSON or invalid fields before trying again. - HTTP 429: the request failed or was limited; inspect the error and stop automatic retries. - Use dry_run:true for a quote without creating an order or checkout session. For real orders, send an Idempotency-Key header and reuse the same key and body after a network timeout. A changed body with the same key returns HTTP 409; do not retry with a new key unless you intend a new order. ### Step 4: Payment and completion With the buyer's approval, send the exact returned amount of USDC on Solana to the returned recipient, using the returned memo. Do not pay using an amount guessed from a fiat exchange rate. Keep the order ID and transaction reference for support. For agentic-readiness-check (and the 1 USDC agentic-readiness-check-test product), completion is automatic: POST the transaction signature to https://aiready.nz/api/public/agent/order/{order_id}/confirm as {"tx_signature": "..."}. The payment is verified on-chain (USDC mint, exact amount, recipient, memo, finalised, signature not previously used) and the full report JSON is returned in the response within seconds. Poll GET https://aiready.nz/api/public/agent/order/{order_id} for status at any time. Once delivered, it returns the full report JSON only when the request carries the header X-Buyer-Email set to the order's email; without it, only status is returned. For competitor-check and deep-scan, card payments through stripe_payment_url are confirmed automatically by Stripe; for USDC, the AIready team manually checks the payment and emails the report to the supplied delivery address, usually within one business day. A successful transfer alone does not confirm fulfilment for those products. ## Payment and fulfilment - A valid order request creates a pending order and returns HTTP 402 with the order ID, Solana USDC amount, recipient, token mint, memo and Solana Pay URL. This is a custom payment-instructions response, not x402 or MPP. - Agentic Readiness Check costs 12 USDC (test mode: agentic-readiness-check-test, 1 USDC); Competitor Check costs 120 USDC; Deep Scan costs 240 USDC. Use USDC on Solana only and include the returned memo in the transfer. - HTTP 402 does not mean payment succeeded. Agentic Readiness Check payments are verified on-chain automatically through the confirm endpoint; Competitor Check and Deep Scan are confirmed manually, usually within one business day, then emailed to the buyer. - There is no agent credential-registration endpoint for public ordering. Repeated POST requests without an Idempotency-Key can create another pending order. ## Authentication boundaries Customer accounts and staff pages use the site's separate sign-in flow. Public ordering does not grant access to private orders, customer accounts or staff tools. Authenticated Poppy sessions are not provided. ## MCP assistant connections The MCP endpoint is https://aiready.nz/mcp and requires OAuth customer sign-in and explicit approval at /.lovable/oauth/consent. The site-root protected-resource metadata at /.well-known/oauth-protected-resource identifies the site origin (https://aiready.nz), which covers /mcp; the anonymous ordering API does not use it. Clients discover the actual authorization server from that metadata and use its published dynamic client registration endpoint. AIready does not issue its own tokens or anonymous agent credentials. Available tools: scan_domain, prepare_readiness_order, list_my_reports and get_report. Preparing an order returns prices and a human intake link; it does not create an order or charge a payment. Report reads use the signed-in customer's existing ownership permissions. No staff tools are exposed. ### OAuth client registration and customer approval 1. GET https://aiready.nz/.well-known/oauth-protected-resource. Use its resource identifier and authorization_servers, not the website origin as an issuer. 2. Read the advertised issuer's /.well-known/oauth-authorization-server. The site also mirrors this metadata at https://aiready.nz/.well-known/oauth-authorization-server and https://aiready.nz/.well-known/openid-configuration without changing issuer or endpoints. 3. Register an OAuth client at the discovered registration_endpoint using the provider's dynamic client registration flow. Supply the client's real redirect_uris; public clients use token_endpoint_auth_method none. Client registration is not customer account creation and does not grant access to reports. 4. Start authorization using authorization_code, a state value, PKCE S256 and the identity scopes openid profile email. The customer signs in and approves the connection on AIready. Cancellation grants no access. 5. Exchange the returned code at the discovered token_endpoint using the same redirect URI and PKCE verifier. Use the OAuth access token only in Authorization: Bearer on https://aiready.nz/mcp. Never copy a browser session token into an integration. 6. Initialize MCP using Streamable HTTP, then call tools/list. Customer report reads remain limited by account ownership. Identity scopes do not grant staff access or permission to charge payments. AIready supports delegated customer OAuth, not WorkOS agent identity registration, identity assertions, anonymous agent credentials or claim/revocation ceremonies. No agent_auth block is advertised because those methods are not implemented. Use the client/provider's available connection management to disconnect; disconnecting locally is not a promise of server-side token revocation. Customer connection and testing guide: https://aiready.nz/connect. Client availability depends on the assistant's plan and OAuth/remote-MCP support. ## Reference - API description: https://aiready.nz/openapi.json - Products and prices: https://aiready.nz/.well-known/agent-products.json - AI catalog: https://aiready.nz/.well-known/ai-catalog.json - Contact: hello@aiready.nz