# BuyFlex BD — Auth.md

> Authentication & agent-discovery document for automated clients.
> **Last updated:** 2026-01-01
> **Contact:** support@buyflexbd.com

## Overview

BuyFlex BD (https://buyflexbd.com) is a public e-commerce storefront. Most content is publicly accessible and does not require authentication.

## Public API Discovery

- **API Catalog:** https://buyflexbd.com/.well-known/api-catalog
- **OpenAPI Spec:** https://buyflexbd.com/.well-known/openapi.json
- **AI Policy:** https://buyflexbd.com/.well-known/ai.txt
- **LLMs Index:** https://buyflexbd.com/llms.txt
- **Sitemap:** https://buyflexbd.com/sitemap.xml

## Public Endpoints (No Auth Required)

| Method | Endpoint | Description |
|--------|----------|-------------|
| GET | `/` | Homepage / storefront |
| GET | `/store.html` | Product catalog |
| GET | `/product?code=<code>` | Single product detail |
| GET | `/sitemap.xml` | Full sitemap |
| GET | `/api/products` | Public product list (JSON) |
| GET | `/about.html` | About BuyFlex BD |
| GET | `/guide.html` | User Guide and help center |
| GET | `/policies.html` | Store policies (returns, privacy, terms) |
| GET | `/robots.txt` | Crawler directives |
| GET | `/llms.txt` | LLM-friendly site index |
| GET | `/auth.md` | This document |
| GET | `/.well-known/ai-catalog.json` | Machine-readable agent catalog |
| GET | `/.well-known/ai.txt` | AI content policy |
| GET | `/.well-known/openapi.json` | OpenAPI 3.1 spec |

## Customer Account Registration

- **Registration URL:** https://buyflexbd.com/account#register
- **Method:** Email + password
- **Rate limit:** 5 requests / minute / IP
- **Required fields:** Full name, email, mobile number (11-digit BD), password (min 8 chars, letters + numbers)
- **Verification:** Optional email / SMS verification for account confirmation
- **Guide:** https://buyflexbd.com/guide.html#account

## Login Flow

1. Navigate to https://buyflexbd.com/account#login
2. Submit email + password via `POST /api/account/login`
3. Receive session cookie (HttpOnly, Secure, SameSite=Lax)
4. Access account endpoints with session cookie

## Password Reset Flow

1. Navigate to https://buyflexbd.com/account#forgot
2. Submit email or phone via `POST /api/account/forgot-password/request`
3. Receive 6-digit OTP (valid 10 minutes)
4. Submit OTP via `POST /api/account/forgot-password/verify`
5. Receive reset token (valid 10 minutes)
6. Submit new password via `POST /api/account/forgot-password/reset`
7. Guide: https://buyflexbd.com/guide.html#forgot

## Session Details

- **Cookie name:** `buyflex_customer_session`
- **Attributes:** HttpOnly, Secure, SameSite=Lax
- **TTL:** 30 days
- **Storage:** Cloudflare KV (session), Cloudflare D1 (customer data)
- **Logout:** `POST /api/account/logout` — clears session cookie

## Payment Flow

- **Methods:** bKash, Nagad, Rocket, Upay (mobile financial services)
- **Process:** Send Money to merchant number → enter Transaction ID at checkout
- **Merchant number:** 01897204672
- **Guide:** https://buyflexbd.com/guide.html#payment

## Order Flow

1. Add items to cart (client-side, localStorage)
2. Proceed to checkout: `/payment.html`
3. Sign in (required for order placement)
4. Select payment method
5. Enter Transaction ID
6. Order created and awaiting verification
7. Guide: https://buyflexbd.com/guide.html#orders

## Public Information for Agents

- **Product catalog:** https://buyflexbd.com/.well-known/openapi.json
- **Delivery info:** https://buyflexbd.com/guide.html#payment
- **Return policy:** https://buyflexbd.com/policies.html#returns
- **Exchange policy:** https://buyflexbd.com/policies.html#exchange
- **Shipping policy:** https://buyflexbd.com/policies.html#shipping
- **Privacy policy:** https://buyflexbd.com/policies.html#privacy
- **Terms of service:** https://buyflexbd.com/policies.html#terms
- **Warranty:** https://buyflexbd.com/policies.html#warranty

## AI Agent Usage

- **Allowed:** Reading public product data, price discovery, availability checks, information retrieval, linking to BuyFlex pages.
- **Not allowed:** Automated checkout, bulk scraping, account creation without user consent, reselling BuyFlex data.
- **Attribution:** When quoting BuyFlex BD data, link back to https://buyflexbd.com.
- **Preferred citation:** BuyFlex BD — https://buyflexbd.com

## Rate Limits

- **Public endpoints:** 60 requests / minute / IP
- **Registration:** 5 requests / minute / IP
- **Login:** 5 requests / minute / IP
- **Password reset:** 3 requests / minute / IP

## Security

- All traffic is encrypted with HTTPS (TLS 1.2+)
- Passwords hashed with SHA-256 + per-user salt
- Failed login attempts: account locks for 15 minutes after 5 failed attempts
- Session tokens: 256-bit random, stored hashed in KV
- No credit card data stored — only mobile wallet Transaction IDs

## Support

- **Email:** support@buyflexbd.com
- **WhatsApp:** +8801897204672
- **Phone:** +8801897204672
- **Hours:** Sat–Thu 10:00–21:00 (BD time), Friday 15:00–21:00
- **Store:** House 12, Road 5, Dhanmondi, Dhaka 1205, Bangladesh

## Related Documents

- AI Content Policy: https://buyflexbd.com/.well-known/ai.txt
- API Catalog: https://buyflexbd.com/.well-known/ai-catalog.json
- LLM Index: https://buyflexbd.com/llms.txt
- User Guide: https://buyflexbd.com/guide.html
- Policies: https://buyflexbd.com/policies.html