# website2vat auth.md

Agent clients can use anonymous OAuth client credentials to keep a stable lookup identity without creating a user account.

1. POST JSON to `https://website2vat.com/oauth/register` to receive a client ID and secret.
2. POST `grant_type=client_credentials`, `client_id`, and `client_secret` to `https://website2vat.com/oauth/token`.
3. Send the short-lived credential in `Authorization: Bearer TOKEN` on every API or MCP request for that lookup.

Supported scopes are `vat:lookup` and `vat:checkout`. Tokens expire after 24 hours; jobs expire after 14 days. Agents can pay through x402 and humans can use hosted Stripe Checkout. This service never accepts wallet private keys or card details. Cookie-based anonymous access remains available to browsers.