---
title: Authentication for alexgreenshpun.com
description: Why the public read-only API and agent protocols require no credentials.
canonical: https://alexgreenshpun.com/auth.md
last-updated: 2026-08-31
---

# Authentication

## Discover

The public REST API, MCP server, A2A endpoint, NLWeb endpoint, Schema Feed, and
discovery documents expose only static facts already published on the website.

## Pick a method

Use anonymous access. No Authorization header, account, API key, OAuth grant,
identity assertion, or browser cookie is accepted or needed.

## Register

There is no registration URI. A client can make its first call immediately:

    curl https://alexgreenshpun.com/api/v1/profile

## Claim

There are no credentials to claim and no user identity is created. The API does
not store request bodies or create a session.

## Use the credential

Send no credential. All documented operations are public, read-only, idempotent,
and safe to retry. Mutation methods return a structured method_not_allowed
error.

## Errors

REST errors use an error object with code, message, and resolution.
MCP and A2A use JSON-RPC errors. NLWeb failures use a response_type of failure.

## Revocation

There is nothing to revoke. If authenticated or state-changing features are ever
added, this document and the relevant OAuth metadata will change before those
features ship.