# auth.md

Box Factory (boxfactory.com) — authentication guidance for automated agents.

## Audience
Automated agents acting on behalf of a Box Factory customer.

## Programmatic agent registration
Not currently offered. Box Factory does not operate an OAuth authorization server,
dynamic client registration (RFC 7591), or an agent provisioning endpoint. There is
no `/.well-known/oauth-authorization-server` or `/.well-known/oauth-protected-resource`
metadata to discover.

## Supported authentication
- **Public content** — the product catalog, custom-box configurator and informational
  pages need no authentication. Discover it via [https://boxfactory.com/llms.txt](https://boxfactory.com/llms.txt),
  [https://boxfactory.com/sitemap.xml](https://boxfactory.com/sitemap.xml) and
  [https://boxfactory.com/.well-known/api-catalog](https://boxfactory.com/.well-known/api-catalog).
- **Account-scoped actions** (orders, profile, checkout) require a session established
  through the site's email/password sign-in by the human account holder. Agents must not
  collect, store, or transmit a user's Box Factory password.

## Credential use
No API keys, client credentials, or agent tokens are issued at this time.

## Requesting access
For programmatic or partnership access, contact contact@packmart.com.