# Auth.md — GetAccidentLawyerNow

This origin is a **public attorney-matching website**. It is not a law firm.

## Agent registration

There is **no OAuth, OIDC, or agent-registration flow**. Do not expect
`/.well-known/openid-configuration` or an authorization server.

Humans request a free case review through the on-page form or by calling
**(267) 212-1034**. Automated clients may use the public lead intake API
only when the injured person has given visible TCPA consent.

## Public resources

| Resource | Auth |
| --- | --- |
| HTML pages, `llms.txt`, `robots.txt`, sitemaps | None (public) |
| `POST /api/leads` | None. Requires JSON contact fields + `consent: true` |
| `GET /api/health` | None |

## Lead intake

```
POST /api/leads
Content-Type: application/json
```

Required:

- `name` (string)
- `phone` (10–15 digits) **or** `email`
- `consent`: `true` (TCPA: phone/text/email by GetAccidentLawyerNow / Ali H. Sheikh, LLC DBA Booked by AI / attorney-network partners, including automated technology; not a condition of purchase)

Optional: `zip`, `incidentType`, `injuryLevel`, `treatmentStatus`, `description`, UTM fields.

Honeypot fields (`website`, `company`, `fax`, `url_field`) must be empty.

OpenAPI: `/openapi.json`

## Protected resource metadata

See `/.well-known/oauth-protected-resource`. `authorization_servers` is empty
because this site does not issue or consume OAuth tokens.

## Agent auth block

```json
{
  "register_uri": null,
  "supported_identity_types": [],
  "credential_types": [],
  "note": "No agent registration. Public matching site."
}
```