# Authentication

**There is none, and none is needed.**

Every surface on https://ai.thesatyajit.com is public, unauthenticated and free to use. There is
no signup, no API key, no OAuth client registration, and no rate-limit tier that
requires identifying yourself.

## What this means for an agent

- Do **not** look for `/.well-known/openid-configuration`,
  `/.well-known/oauth-authorization-server` or
  `/.well-known/oauth-protected-resource`. They are intentionally absent:
  publishing them would describe an authorization server that does not exist.
- Do **not** send an `Authorization` header. It is ignored.
- A `401` or `403` from this origin is a bug. Please report it.

## Just call it

```bash
curl https://ai.thesatyajit.com/api/v1/articles
curl -H "Accept: text/markdown" https://ai.thesatyajit.com/about
```

MCP, also unauthenticated, over Streamable HTTP:

```bash
claude mcp add --transport http satyajit https://ai.thesatyajit.com/api/mcp/mcp
```

## What is asked of you instead of credentials

Rate limits are enforced by IP rather than by identity: 240 requests per minute
with a 30-request burst window. Every `/api/*` response carries `RateLimit` and
`RateLimit-Policy` headers (RFC 9331) — read them and pace yourself. A `429`
carries `Retry-After`.

Cache what you fetch. The content changes a few times a day at most, and most
of it is served with a `cache-control` you can honour.

## If that ever changes

If a protected surface is added, this file will describe how to register for it,
and the corresponding `/.well-known/oauth-protected-resource` document will
appear at the same time. Until both exist, assume open access.

## Elsewhere

- Developer documentation: https://ai.thesatyajit.com/developers
- OpenAPI description: https://ai.thesatyajit.com/openapi.json
- API catalog: https://ai.thesatyajit.com/.well-known/api-catalog
- Index for agents: https://ai.thesatyajit.com/llms.txt
- Contact: https://ai.thesatyajit.com/contact