{"name":"Altixia ID","description":"The identity provider for Altixia's tools. Tells an agent how to obtain an Altixia ID credential and which credential each Altixia service takes — both without any credential — and, with the caller's own token, whether that token is live and whose it is. Issues no token itself: tokens come from the OAuth endpoints.","supportedInterfaces":[{"url":"https://id.altixia.com/a2a","protocolBinding":"JSONRPC","protocolVersion":"1.0"}],"provider":{"organization":"Altixia LLC","url":"https://altixia.com"},"version":"1.0.0","documentationUrl":"https://id.altixia.com/auth.md","capabilities":{"streaming":false,"pushNotifications":false,"extendedAgentCard":false},"securitySchemes":{"altixiaId":{"openIdConnectSecurityScheme":{"openIdConnectUrl":"https://id.altixia.com/.well-known/openid-configuration","description":"An Altixia ID access token, sent as `Authorization: Bearer <token>`. Only whoami needs one. See https://id.altixia.com/auth.md."}}},"defaultInputModes":["application/json","text/plain"],"defaultOutputModes":["application/json","text/plain"],"skills":[{"id":"how_to_authenticate","name":"How to obtain an Altixia ID credential","description":"Which OAuth 2.0 grants Altixia ID accepts, at which URLs, and which one fits: the device-code grant or the authorization code with PKCE for an agent acting for a person, client credentials for an agent acting as itself. Needs no credential. Send a `data` Part {\"skill\": \"how_to_authenticate\"}. No token is issued here: tokens come from the token endpoint this answer names.","tags":["identity","authentication","oauth2","openid-connect"],"examples":["How does an agent get a token for an Altixia service?","I have no browser: how do I sign in to Altixia ID?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"which_credential","name":"Which credential an Altixia service takes","description":"Says which credential each Altixia service accepts — an Altixia ID access token or an Altixia Sign API token. Presenting one where the other is expected is refused in a way that looks like an expired token. Needs no credential. Send a `data` Part {\"skill\": \"which_credential\", \"service\"?: \"sign.altixia.com\"}; without `service`, every service is listed.","tags":["identity","credentials","api-token","troubleshooting"],"examples":["Does sign.altixia.com take my Altixia ID token?","My call to an Altixia service was refused: is it the wrong kind of token?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"whoami","name":"Whose token is this","description":"Says whether the caller's own Altixia ID access token is live and whose it is — or plainly that no token was sent, or that it was refused, three answers kept distinct. Send the token as `Authorization: Bearer <access token>` on the A2A request and a `data` Part {\"skill\": \"whoami\"}. The token is relayed to the userinfo endpoint and never stored or logged.","tags":["identity","token-validation","userinfo"],"examples":["Am I still signed in to Altixia?","Who does this bearer token belong to?"],"inputModes":["application/json"],"outputModes":["application/json","text/plain"],"securityRequirements":[{"schemes":{"altixiaId":{"list":["openid"]}}}]}]}