# Lumi auth.md

## Audience and public access

Agents can read Lumi's public documentation, pricing, API overview, capability catalog,
and skills without an account or access token. Start with the
[capability catalog](https://www.lumicatalog.com/.well-known/ai-catalog.json) and
[API documentation](https://www.lumicatalog.com/docs/api).

Lumi does not currently offer programmatic agent registration, OAuth client registration,
agent credentials, or delegated OAuth scopes on this domain. There is no agent
registration or provisioning endpoint. No ID-JAG, verified-email, anonymous registration,
claim, or agent credential revocation flow is supported here. Do not invent an issuer,
token endpoint, client secret, or bearer token from the public discovery documents.

## Partner accounts

The [partner dashboard](https://www.lumicatalog.com/partners/dashboard) uses interactive
Clerk sign-in. The user can create a partner account at
[sign-up](https://www.lumicatalog.com/sign-up) or access an existing account at
[sign-in](https://www.lumicatalog.com/sign-in). Partner API routes require the user's
Clerk session and are not a delegated agent API. Public discovery grants no access
to partner commissions or payouts. Keep session credentials private.

## Shopify merchant access

To access a merchant's catalog, the merchant must install
[Lumi from the Shopify App Store](https://apps.shopify.com/lumi-ai-seo-alt-text)
and approve the requested Shopify permissions. Shopify installation and billing
happen in Shopify. This website does not issue Shopify access tokens to agents.

Merchant-started batches create drafts for review. Maintain automation is opt-in
and can publish automatically if the merchant chooses that setting. Category and
metafield drafts always require approval. Do not publish catalog changes or
change automation settings without the merchant's authorization.

## Public tools

The browser tools only list public resources and open public pages. Scans and
contact forms retain their existing validation and abuse protections. Ask the
user before sharing their email address. Public access does not bypass rate
limits or authorize access to private merchant data.

For integration questions, use [Lumi support](https://www.lumicatalog.com/contact).