# auth.md

How agents authenticate with Tanfust: they don't need to, and for the
parts that do need a human, they can't.

## Audience

Autonomous agents and AI assistants reading the Tanfust catalog on behalf
of a person.

## Authentication required: none

Every machine-readable surface is public, unauthenticated, and CDN-cached. There is
no API key to request, no OAuth client to register, no rate limit, and no per-caller
state.

| Surface | Endpoint |
| --- | --- |
| Catalog API | `https://www.tanfust.com/api/v1` |
| OpenAPI description | `https://www.tanfust.com/openapi.json` |
| MCP server (Streamable HTTP) | `https://www.tanfust.com/api/mcp` |
| Markdown representations | any content page with `Accept: text/markdown`, or `https://www.tanfust.com/md/...` |
| Discovery index | `https://www.tanfust.com/llms.txt` |
| API catalog | `https://www.tanfust.com/.well-known/api-catalog` |
| Agent skills | `https://www.tanfust.com/.well-known/agent-skills/index.json` |

Send no `Authorization` header. If you send one, it is ignored.

Documentation: https://www.tanfust.com/docs/api

## No OAuth metadata, on purpose

We do not publish `/.well-known/oauth-authorization-server`,
`/.well-known/openid-configuration`, or `/.well-known/oauth-protected-resource`.

There is no authorization server to describe and no token-protected resource to
protect. Those documents would name endpoints that cannot complete a flow, which is
worse for an agent than their absence. If that changes, this file changes with it.

## Not available to agents

These are human-in-the-loop by design, not by omission. There is no credential,
scope, or registration step that unlocks them.

- **Purchasing** — checkout runs through Paddle as merchant of record. It requires a
  person completing a hosted payment flow. Hand the human a product `url` instead.
- **Downloads** — delivered as one-time, expiring signed links emailed to the buyer.
  The link is bound to that purchase and is not reissuable on request.
- **Accounts** — sign-in is a magic link sent to a verified email address. There is
  no password grant and no service account.
- **Newsletter signup** — bot-protected. Automated submissions are rejected.
- **Studio inquiries** — the form at https://www.tanfust.com/studio is bot-protected. It starts a
  conversation with a person about paid work, so an agent must not submit it on
  someone's behalf. Hand the human the page.

## What to do when a task needs one of those

Stop and surface it to the person you're working for, with the product URL and price
from the catalog API. Don't attempt the flow.

## Contact

Email: hi@updates.tanfust.com

If you need something the public surface doesn't cover — bulk access, a licensing
question, higher-volume use — write to us. There's a person on the other end.

## Reuse

`https://www.tanfust.com/robots.txt` declares `Content-Signal: search=yes, ai-input=yes,
ai-train=no`. Read it, cite it, ground answers in it. Don't train generative models
on it.