# Agent Authentication — Maventech

## Summary

The Maventech catalog is a **public, read-only** agent surface. Browsing products, reading content and fetching prices require **no authentication** — no API key, no OAuth, no bearer token.

## Discovery

- OpenAPI 3.1 spec: `https://maventechsoftware.com/openapi.json`
- JSON Catalog API: `https://maventechsoftware.com/api` (products, categories, health)
- Developer hub: `https://maventechsoftware.com/developers`
- API catalog (RFC 9727): `https://maventechsoftware.com/.well-known/api-catalog`
- Agent skills: `https://maventechsoftware.com/.well-known/agent-skills.json`
- MCP server card: `https://maventechsoftware.com/.well-known/mcp.json`
- Manifest: `https://maventechsoftware.com/agents.json` · Summary: `https://maventechsoftware.com/llms.txt` · Instructions: `https://maventechsoftware.com/AGENTS.md`

## OAuth metadata

- Authorization server: `https://maventechsoftware.com/.well-known/oauth-authorization-server`
- Protected resource: `https://maventechsoftware.com/.well-known/oauth-protected-resource`

Both advertise `access: public` / `grant_types: none` — i.e. there is nothing to authorize for catalog reads.

## Customer-scoped actions

Order status is retrieved with the customer's own order number **and** the email on that order (`https://maventechsoftware.com/track-order.php`). Purchases and account changes are intentionally **not** available to agents and require a human in the loop.

## Contact

- Email: services@maventechsoftware.com
- Support: `https://maventechsoftware.com/contact.php`