Update the Mintlify post: the gap it admits was closed the same day

The post published this morning saying our own descriptor still advertised
console-only issuance and an info@apis.io address. That was corrected
hours later, so the paragraph was false by lunchtime.

Appended a dated update rather than editing the admission away — the
original sentence stays on the record, which was the point of writing it.

The update carries the part that actually matters: correcting the file
turned up that apis.io had supported RFC 7591 DCR and CIMD all along with
no artifact naming either, which is precisely the failure the post spends
three sections accusing Mintlify of. Wrote the whole thing without knowing
I was standing in it.

Also records that apis.io is now an AAuth resource that verifies a caller
it has never registered, with both limits stated plainly: one agent
provider in the allowlist and we run it, and an agent still cannot buy
anything because the token endpoint offers no client_credentials.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: kinlane

_posts/2026-08-31-mintlify-put-signup-in-the-cli-when-it-was-already-in-the-protocol.md

@@ -72,6 +72,14 @@ That returns results, on the Free tier, at 1,000 requests a day. The OpenAPI con
 
 Being honest about this is the entire reason the descriptor has a `gaps` array, so here it is. Our published descriptor is stale. It still lists a `console-only` mechanism saying keyed tiers are issued by a human at info@apis.io and that "a self-serve GitHub OAuth + billing flow is built and pending deployment." That flow shipped. The human documentation page says a Starter key is free with a GitHub sign-in and that Pro and Business are self-serve from your account page. The machine-readable file drifted away from the human page, which is precisely the failure I spend my days pointing at in other people's catalogs. It is going to be corrected, and I would rather write that sentence than quietly fix it and pretend the drift never happened.
 
+**Update, later the same day.** It is corrected. `apis.io/.well-known/api-onboarding` now declares `browser-oauth` — honestly labelled as needing a human — in place of the `console-only` fiction. I am leaving the paragraph above as I wrote it, because the fix is not the interesting part.
+
+This is: while correcting it I found we had been committing *exactly the sin I just accused Mintlify of*. The apis.io authorization server has supported RFC 7591 dynamic client registration and Client ID Metadata Documents all along, and **no artifact anywhere said so**. An agent reading our descriptor could not discover the better of our two registration paths — the same shape as Mintlify shipping a live `registration_endpoint` that only appears if you go looking for a well-known file nobody mentions. I wrote three sections of this post about that failure without knowing I was standing in it. Both are now declared.
+
+Then we went one further, because the argument obliges it. apis.io is now an [AAuth](https://www.aauth.dev/) resource: an agent holding its own Ed25519 keypair, carrying a token in which an agent provider vouches for its `aauth:local@domain` identifier, signing the request per RFC 9421, gets recognised by a service it has never registered with. No account, no key, no browser, at any step. The descriptor declares that door too, and says exactly what it is worth — the free tier and attribution, GET and HEAD only. Identity is not payment.
+
+Two things I will not dress up. There is one agent provider in that allowlist and we run it; a probe of 1,486 hosts found no other AAuth resource document anywhere in our catalog, so this is a worked example and not an ecosystem. And an agent can now arrive with no human at all and *still cannot buy anything*, because our token endpoint offers `authorization_code` and `refresh_token` and nothing else. The last human-shaped step in the chain is the one where money changes hands, which is a more interesting place for it to be than the signup form — but it is still there, and the descriptor says so in a `gaps` array that got longer today, not shorter.
+
 ## The ask
 
 `mint signup` is a good command. Keep it. But Mintlify is not just an API provider, it is the documentation layer for a very large number of API providers, and that makes this a much bigger lever than one CLI verb. If Mintlify emitted an onboarding descriptor for every docs site it hosts — reading what it already knows about a customer's auth setup, their plans, their OAuth metadata, their MCP server — thousands of API providers would get a machine-readable front door for free, on the same day, without any of them writing a line of code. That is the version of this that scales past one company's terminal.