# Auth.md for Wsend

Wsend provides public web tools for creating WhatsApp links, WhatsApp QR Codes, and optional public Wsend profile/link pages.

## Public Web Use

- Public pages and public tool pages can be read by agents and crawlers that respect robots.txt and normal rate limits.
- Human users can create WhatsApp links through the public Wsend web form.
- Agents must not automatically submit the public form, create real profiles, send WhatsApp messages, or store private data without explicit user action.

## Agent API Boundary

Wsend exposes a limited preview-only agent API for discovery and safe link/QR previews.

- OpenAPI: https://wsend.pro/openapi.json
- API catalog: https://wsend.pro/.well-known/api-catalog
- OAuth authorization server metadata: https://wsend.pro/.well-known/oauth-authorization-server
- OAuth protected resource metadata: https://wsend.pro/.well-known/oauth-protected-resource
- MCP server card: https://wsend.pro/.well-known/mcp/server-card.json
- MCP endpoint: https://wsend.pro/mcp

The agent API is read-only and preview-only. It can describe public Wsend resources and preview WhatsApp link or QR payloads. It does not create Wsend public profiles, submit WordPress forms, send messages, access private data, or bypass abuse controls.

## OAuth

The preview API uses OAuth 2.0 client credentials. Dynamic client registration and token endpoints are published for agent discovery:

- Register a client: POST https://wsend.pro/oauth/register
- Request a token: POST https://wsend.pro/oauth/token
- Revoke a preview token: POST https://wsend.pro/oauth/revoke

Use the issued bearer token only for the preview API resource:
https://wsend.pro/api/agent/v1

## Agent Auth Metadata

```json
{
  "agent_auth": {
    "skill": "https://wsend.pro/auth.md",
    "register_uri": "https://wsend.pro/oauth/register",
    "registration_endpoint": "https://wsend.pro/oauth/register",
    "token_uri": "https://wsend.pro/oauth/token",
    "revocation_uri": "https://wsend.pro/oauth/revoke",
    "resource": "https://wsend.pro/api/agent/v1",
    "identity_types_supported": ["anonymous"],
    "credential_types_supported": ["oauth2_client_credentials", "bearer_token"],
    "scopes_supported": ["agent.read", "link.preview", "qr.preview"],
    "claim_required": false,
    "human_user_required": false,
    "preview_only": true
  }
}
```

These credentials are limited to read-only preview and discovery APIs. They do not create public Wsend profiles, submit public forms, send WhatsApp messages, or access private user data.

## Safety and Abuse

- Wsend is independent and is not affiliated with WhatsApp or Meta.
- Wsend never asks for a WhatsApp password, verification code, or private WhatsApp account credential.
- Users and agents must not create spam profiles, impersonation pages, phishing flows, or unauthorized business/contact pages.
- Abuse, phishing, impersonation, unauthorized number use, unauthorized logo/name/image use, copyright/DMCA issues, or security concerns can be reported at https://wsend.pro/abuse-report/