# auth.md — AllMyPeptides Authentication

This document describes how automated agents and API clients authenticate with
`https://allmypeptides.com`.

## Summary

- **Scheme:** session cookie (`amp_sess`, HttpOnly, Secure, SameSite=Lax, 30-day lifetime)
- **OAuth 2.0 / OpenID Connect:** **not supported.** There is no authorization
  server, token endpoint, or `/.well-known/openid-configuration` on this domain.
- **Agent self-registration:** agents may create a standard customer account via
  the JSON API below, on behalf of a human owner. One account per human customer.
- **API description:** [OpenAPI spec](/openapi.json) · [API catalog](/.well-known/api-catalog) · [Docs](/docs/api/)

## Creating an account

```
POST /api/auth/signup
Content-Type: application/json

{
  "email": "person@example.com",
  "password": "min 6 characters",
  "firstName": "Ada",
  "lastName": "Lovelace",
  "phone": "optional",
  "referralCode": "optional AMPXXXX code"
}
```

A successful response sets the `amp_sess` cookie and returns the profile and
loyalty account (new accounts receive a 100-point welcome bonus).

## Logging in

```
POST /api/auth/login
Content-Type: application/json

{ "email": "person@example.com", "password": "..." }
```

Store and replay the `amp_sess` cookie (a standard cookie jar works). Check the
current session with `GET /api/auth/me`; end it with `POST /api/auth/logout`.

## Notes for agents

- All requests must be HTTPS. Send and receive JSON.
- The session cookie is the only credential. There are no API keys or bearer
  tokens to discover, request, or refresh.
- Accounts represent human customers. Do not create accounts without the
  knowledge and consent of the person whose details are used.
- Orders are paid by a human on SumUp's hosted checkout page; agents can prepare
  a checkout via `POST /api/create-checkout` (see the OpenAPI spec) and hand the
  returned payment link to their human.
- Products are research-use-only chemicals. Purchases must comply with the
  site's [terms](https://allmypeptides.com/terms/) and applicable law.

## Support

Questions: support@allmypeptides.com · https://allmypeptides.com/contact/