# auth.md

How authentication works on glob.ai.

## Public, unauthenticated surface

No credentials are needed for:

- `GET /api/catalog` — the AI Pods catalog (JSON)
- `GET /api/v1/health` — platform API health
- Discovery documents: `/.well-known/api-catalog`, `/openapi.json`,
  `/docs/api.md`, `/.well-known/agent-skills/index.json`, `/llms.txt`,
  `/llms-full.txt`

## Authentication

Everything else is available to signed-in users only. Authentication is
user-based single sign-on through Globant Access Management (GAM); sessions
are managed by the platform. There is no password grant, no
client-credentials flow, and no API-key self-service.

## What does not exist (yet)

Stated explicitly so agents don't probe for it:

- No self-service or anonymous agent registration — any programmatic access
  is provisioned by authenticated users from within the platform.
- No OAuth/OIDC discovery metadata (`/.well-known/openid-configuration`,
  `/.well-known/oauth-authorization-server`,
  `/.well-known/oauth-protected-resource`) — this origin is not an OAuth
  issuer.
- No agent-autonomous payments; checkout requires human card entry.

## Getting access

Start at https://glob.ai — access is granted through a reviewed request,
and provisioning is human-in-the-loop.