---
name: legendasbr-auth
issuer: https://legendas.legendasbr.site
authorization_server_metadata: https://legendas.legendasbr.site/.well-known/oauth-authorization-server
protected_resource_metadata: https://legendas.legendasbr.site/.well-known/oauth-protected-resource
register_uri: https://legendas.legendasbr.site/oauth/register
token_uri: https://legendas.legendasbr.site/oauth/token
supported_identity_types:
  - anonymous
  - agent
  - client_credentials
credential_types:
  - none
  - bearer_token
  - api_key
---

# LegendasBR — Agent Authentication & Registration (`auth.md`)

## 1. Public Read-Only Access (No Authentication Required)
All subtitle discovery, download, and telemetry endpoints are publicly accessible to AI agents and Stremio clients without requiring an access token:

- **Manifest**: `GET https://legendas.legendasbr.site/manifest.json`
- **Search Subtitles**: `GET https://legendas.legendasbr.site/subtitles/{type}/{id}.json` (where `type` is `movie` or `series`, and `id` is an IMDb ID such as `tt0113247` or `tt0100044:1:1`)
- **Download Subtitle (`.srt`)**: `GET https://legendas.legendasbr.site/subtitles/download/{filename}.srt`
- **Server Telemetry**: `GET https://legendas.legendasbr.site/stats`
- **MCP Endpoint**: `POST https://legendas.legendasbr.site/mcp`
- **A2A Endpoint**: `POST https://legendas.legendasbr.site/a2a`

## 2. Dynamic Agent Registration (OAuth 2.0 / Agent Auth)
Agents requiring an explicit client credential or bearer token for higher rate limits can register programmatically:

1. **Discover Metadata**:
   - Authorization Server: `GET https://legendas.legendasbr.site/.well-known/oauth-authorization-server`
   - Protected Resource: `GET https://legendas.legendasbr.site/.well-known/oauth-protected-resource`
2. **Register Agent**:
   - `POST https://legendas.legendasbr.site/oauth/register` with JSON body `{"client_name": "your-agent-name", "grant_types": ["client_credentials"]}`
3. **Obtain Token**:
   - `POST https://legendas.legendasbr.site/oauth/token` with `grant_type=client_credentials`

## 3. Administrative Endpoints
- **Cache Purge (`GET/DELETE /cache/purge/{key}`)**: Restricted to local loopback (`127.0.0.1`) or requests carrying the `X-Admin-Token` header.