{
  "resource": "https://laso.finance/",
  "resource_name": "Laso Finance",
  "authorization_servers": ["https://laso.finance"],
  "bearer_methods_supported": ["header"],

  "issuer": "https://laso.finance",
  "token_endpoint": "https://laso.finance/auth",
  "grant_types_supported": ["refresh_token"],
  "service_documentation": "https://laso.finance/SKILL.md",

  "agent_auth": {
    "skill": "https://laso.finance/auth.md",
    "register_uri": "https://laso.finance/auth",
    "claim_endpoint": "https://laso.finance/get-auth-link",
    "identity_types_supported": ["anonymous", "service_auth"],
    "credential_types_supported": ["id_token", "refresh_token", "api_key"],

    "registration_methods": [
      {
        "identity_type": "anonymous",
        "register_uri": "https://laso.finance/auth",
        "method": "GET",
        "presentation": "SIGN-IN-WITH-X header (base64-encoded CAIP-122 signed message)",
        "human_required": false,
        "description": "The agent proves control of a wallet keypair and receives credentials for the Laso account bound to that wallet. No human identity is asserted, and the account is created on first use. Base and Solana wallets are both accepted."
      },
      {
        "identity_type": "service_auth",
        "register_uri": "https://laso.finance/agentAuth",
        "method": "POST",
        "presentation": "Authorization: Bearer <api_key>",
        "human_required": true,
        "issuance_uri": "https://laso.finance/agent/dashboard",
        "description": "A human creates the account and issues the agent an api_key from the dashboard, then the agent exchanges that key for a session. Use this when the agent and a human share one Laso account."
      }
    ],

    "credentials": {
      "id_token": {
        "format": "jwt",
        "presentation": "Authorization: Bearer <id_token>",
        "expires_in": 3600,
        "renewal": "refresh_token grant at the token_endpoint"
      },
      "refresh_token": {
        "presentation": "JSON request body at the token_endpoint",
        "grant_type": "refresh_token"
      },
      "api_key": {
        "prefix": "lasoak_",
        "presentation": "Authorization: Bearer <api_key>",
        "lifetime": "long-lived",
        "issuance_uri": "https://laso.finance/agent/dashboard",
        "issued_to": "human",
        "description": "Only issued through the human-facing dashboard; an agent cannot mint one for itself."
      }
    },

    "revocation": {
      "agent_callable": false,
      "contact": "agents+support@laso.finance",
      "description": "There is no RFC 7009 revocation endpoint. An id_token cannot be revoked before its one-hour expiry; an api_key is revoked by the human who owns the account, which invalidates every session minted from it."
    },

    "human_verification": {
      "status_endpoint": "https://laso.finance/get-kyc-status",
      "link_endpoint": "https://laso.finance/get-kyc-link",
      "agent_completable": false,
      "description": "Optional and only required by some endpoints. The agent reads the requirement and hands the returned link to its human, who completes the form. Everything around it is agent-drivable."
    }
  }
}