{
  "catalog_id": "lime-agent-flows",
  "version": "1.0.0",
  "updated": "2026-08-05T19:20:46.676Z",
  "base_url": "https://lime.pics",
  "primary": true,
  "flows": [
    {
      "id": "mcp_oauth_token",
      "name": "Mint MCP access JWT",
      "description": "Primary wire: agent authenticates to LIME with Agent Token; LIME issues a hostname-bound MCP OAuth JWT (passport over MCP transport); agent calls an external MCP server with Bearer only. Site Token is not used.",
      "auth": "X-Agent-Token on LIME token endpoint",
      "ttl_seconds": 300,
      "endpoints": [
        "POST /api/v1/modules/oauth/token",
        "GET /api/v1/modules/oauth/.well-known/oauth-authorization-server",
        "GET /.well-known/oauth-authorization-server",
        "GET /api/v1/core/.well-known/jwks.json"
      ],
      "details": {
        "url": "/.well-known/agent-context/flows.json",
        "flow_id": "mcp_oauth_token"
      },
      "skill": {
        "id": "lime-mcp-oauth",
        "url": "/.well-known/agent-skills/lime-mcp-oauth/SKILL.md"
      }
    },
    {
      "id": "verify_mcp_token",
      "name": "Verify MCP JWT on resource server",
      "description": "External MCP server verifies Bearer MCP JWT for its hostname and reads agent_id. No Site Token and no Agent Token on the RS.",
      "auth": "None to LIME for verify; RS uses TokenVerifier",
      "ttl_seconds": 300,
      "endpoints": [
        "GET /api/v1/modules/oauth/.well-known/oauth-authorization-server",
        "GET /.well-known/oauth-authorization-server",
        "GET /api/v1/core/.well-known/jwks.json"
      ],
      "details": {
        "url": "/.well-known/agent-context/flows.json",
        "flow_id": "verify_mcp_token"
      },
      "skill": {
        "id": "lime-verify-mcp",
        "url": "/.well-known/agent-skills/lime-verify-mcp/SKILL.md"
      }
    },
    {
      "id": "site_login",
      "name": "Agent site login",
      "description": "Secondary: browser hits Sign in with LIME; site creates a login request, shows login_request_id on the waiting screen for the agent to read, waits on SSE, verifies AIT passport, sets site session cookie.",
      "auth": "X-Site-Token for create/events/status; X-Agent-Token for approve",
      "ttl_seconds": 120,
      "endpoints": [
        "POST /api/v1/modules/agent-login/requests",
        "GET /api/v1/modules/agent-login/events",
        "GET /api/v1/modules/agent-login/requests/{login_request_id}",
        "GET /api/v1/auth/requests/{login_request_id}",
        "POST /api/v1/modules/agent-login/requests/{login_request_id}/approve",
        "GET /api/v1/core/.well-known/jwks.json"
      ],
      "details": {
        "url": "/.well-known/agent-context/flows.json",
        "flow_id": "site_login"
      },
      "skill": {
        "id": "lime-site-login",
        "url": "/.well-known/agent-skills/lime-site-login/SKILL.md"
      }
    },
    {
      "id": "agent_binding",
      "name": "Bind signed-in user to agent",
      "description": "Secondary: signed-in site user links account to an agent via LIME Connect. Site verifies binding passport and stores agent_id. Does not open a new site session cookie.",
      "auth": "X-Site-Token for create; portal lime_session for Connect UI complete",
      "ttl_seconds": 600,
      "endpoints": [
        "POST /api/v1/modules/bindings/requests",
        "GET /api/v1/core/.well-known/jwks.json"
      ],
      "details": {
        "url": "/.well-known/agent-context/flows.json",
        "flow_id": "agent_binding"
      },
      "skill": {
        "id": "lime-agent-binding",
        "url": "/.well-known/agent-skills/lime-agent-binding/SKILL.md"
      }
    },
    {
      "id": "verify_passport",
      "name": "Verify AIT passport JWT",
      "description": "Site verifies site-login or binding passport using JWKS. Crypto verify is not a substitute for business correlation of request_id or binding_id.",
      "auth": "Local JWKS verify via lime-sites-sdk",
      "ttl_seconds": 60,
      "endpoints": [
        "GET /api/v1/core/.well-known/jwks.json"
      ],
      "details": {
        "url": "/.well-known/agent-context/flows.json",
        "flow_id": "verify_passport"
      },
      "skill": {
        "id": "lime-verify-passport",
        "url": "/.well-known/agent-skills/lime-verify-passport/SKILL.md"
      }
    }
  ],
  "links": {
    "context_package": "/.well-known/agent-context/index.json",
    "oauth_metadata": "/.well-known/oauth-authorization-server",
    "jwks": "/api/v1/core/.well-known/jwks.json",
    "docs_guides": "/docs/guides/",
    "agent_skills": "/.well-known/agent-skills",
    "api_catalog": "/.well-known/api-catalog"
  }
}