---
title: Ur&Penn Agent Authentication & Access Walkthrough (auth.md)
description: WorkOS-conformant agent authentication, anonymous MCP/UCP discovery, and BankID checkout handoff guide for uropenn.se.
canonical: https://uropenn.se/auth.md
last-updated: 2026-11-06
---

# Agent Authentication & Access Guide — Ur&Penn (`uropenn.se`)

Ur&Penn (`https://uropenn.se`) provides **zero-friction anonymous read access** for AI agents across all documentation, discovery, pricing, policy, and cart-handoff preparation endpoints, paired with **RFC 9421 (HTTP Message Signatures)** for UCP 2026-04-08 and **RFC 9728 / RFC 8414 `agent_auth`** discovery metadata for agents that manage scoped capability tokens. Human account authentication and payment authorization on `uropenn.se` strictly use **Swedish BankID** and **Svea Checkout** via UCP Cart Handoff (`https://uropenn.se/cart/handoff`).

## 1. Discover

Agents can discover authentication and resource metadata automatically using RFC 9728, RFC 8414, and `WWW-Authenticate` signposts:

- **Protected Resource Metadata (RFC 9728):** `https://uropenn.se/.well-known/oauth-protected-resource`
- **Authorization Server & `agent_auth` Metadata (RFC 8414):** `https://uropenn.se/.well-known/oauth-authorization-server`
- **Agent Resource Discovery (ARD v0.91):** `https://uropenn.se/.well-known/ard.json`
- **Universal Commerce Protocol (UCP):** `https://uropenn.se/.well-known/ucp`
- **401 Signpost Header:** Unauthenticated requests to protected agent identity endpoints (such as `GET https://uropenn.se/agent/identity`) return `HTTP 401 Unauthorized` with:
  `WWW-Authenticate: Bearer resource_metadata="https://uropenn.se/.well-known/oauth-protected-resource", scope="catalog:read docs:read cart:handoff"`

## 2. Pick a method

Choose the integration method matching your agent workflow:

1. **Anonymous Read + Cart Handoff (Recommended for Shopping Agents):**
   - No API key or Bearer token is required for `https://uropenn.se/api/docs/mcp`, `https://uropenn.se/api/ucp/mcp?sandbox=true` (or header `X-UCP-Sandbox: true`), `https://uropenn.se/.well-known/ucp`, or `https://uropenn.se/llms.txt`.
   - When the shopper is ready to purchase, redirect the human user to `https://uropenn.se/cart/handoff?items={sku}:{qty}`.
2. **Scoped `agent_auth` Capability Token (Optional for Registered Agent Platforms):**
   - Use the `agent_auth` endpoints advertised in `https://uropenn.se/.well-known/oauth-authorization-server` (`catalog:read`, `docs:read`, `cart:handoff`).
   - Append `?sandbox=true` or send `X-UCP-Sandbox: true` for deterministic sandbox testing.

## 3. Register

To register an autonomous agent identity and obtain an `agent_id`, send a `POST` request to `https://uropenn.se/agent/register`:

```bash
curl -sS -X POST https://uropenn.se/agent/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "shopping-assistant", "client_uri": "https://example.com", "scopes": ["catalog:read", "docs:read", "cart:handoff"]}'
```

The endpoint returns a JSON payload containing `agent_id`, `registration_token`, `claim_url`, and `token_endpoint`.

## 4. Claim

If a human user or organization wishes to bind the registered agent session to a verified session or inspect the claim status, open or poll `https://uropenn.se/agent/claim`:

```bash
curl -sS "https://uropenn.se/agent/claim?agent_id=ag_uropenn_demo"
```

Note: Personal order history on `uropenn.se` is protected by Swedish BankID and is never exposed to third-party agents without interactive human sign-in.

## 5. Exchange

Exchange a registration or authorization grant for a short-lived Bearer capability token at `https://uropenn.se/agent/token`:

```bash
curl -sS -X POST https://uropenn.se/agent/token \
  -H "Content-Type: application/json" \
  -d '{"grant_type": "client_credentials", "agent_id": "ag_uropenn_demo", "scope": "catalog:read docs:read cart:handoff"}'
```

Response (`200 OK`, `application/json`):

```json
{
  "access_token": "uop_agent_sandbox_token_v1",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "catalog:read docs:read cart:handoff"
}
```

## 6. Use

Pass the Bearer token in the `Authorization` header when calling `https://uropenn.se/agent/identity`, `https://uropenn.se/agent/capabilities`, or MCP endpoints:

```bash
curl -sS https://uropenn.se/agent/identity \
  -H "Authorization: Bearer uop_agent_sandbox_token_v1"
```

For catalog search via MCP (`https://uropenn.se/api/ucp/mcp`) or documentation lookup (`https://uropenn.se/api/docs/mcp`), requests to `/api/docs/mcp` are open anonymously and `/api/ucp/mcp` accepts the `uop_agent_sandbox_token_v1` Bearer token, `?sandbox=true`, `X-UCP-Sandbox: true`, or an authorized `x-ucp-api-key`.

## 7. Errors

All agent authentication and MCP endpoints return structured JSON errors (`Content-Type: application/json`) with standard OAuth 2.0 / RFC 6750 error codes:

- `401 Unauthorized`: Missing or expired Bearer token on `/agent/identity`. Includes `WWW-Authenticate: Bearer resource_metadata="https://uropenn.se/.well-known/oauth-protected-resource"`.
- `400 Bad Request`: Malformed JSON body or unsupported `grant_type`.
- `403 Forbidden`: Requested scope exceeds public storefront capabilities.
- `429 Too Many Requests`: Rate limit exceeded; inspect `Retry-After`.

## 8. Revocation

Revoke an active agent token at any time by calling `POST https://uropenn.se/agent/revoke`:

```bash
curl -sS -X POST https://uropenn.se/agent/revoke \
  -H "Content-Type: application/json" \
  -d '{"token": "uop_agent_sandbox_token_v1"}'
```

Returns `200 OK` with `{"revoked": true, "status": "revoked"}`.