# Lucis.life auth docs

Lucis.life does not require authentication for the public biomarker catalog.

## Discover

- RFC 8414 metadata: GET https://www.lucis.life/.well-known/oauth-authorization-server
- RFC 9728 protected resource: GET https://www.lucis.life/.well-known/oauth-protected-resource

## Claim an optional token

POST https://www.lucis.life/oauth/token with `grant_type=client_credentials` and `scope=catalog.read`. Public clients send no client secret (`token_endpoint_auth_methods_supported: none`).

## Use the credential

Send `Authorization: Bearer <token>` if you have one. The catalog GET also works with no token. On HTTP 429, honour RateLimit, RateLimit-Policy, and Retry-After.

## Errors

Catalog errors use `application/problem+json` (RFC 9457). Token errors follow RFC 6749.

## Revocation

Tokens last 3600 seconds. There is no revocation endpoint: wait for expiry.

Lucis does not replace medical advice. Our content is educational. If in doubt, speak with a healthcare professional.