# auth.md

The Direct Index is an open service. AI agents and automated clients need no account, API key, OAuth flow or registration to read scores, run scans, or use the MCP, A2A and JSON APIs at https://directindex.org. An API key exists, is optional, and only raises the scan limit.

## Audience
Agents acting for a business owner, an agency, a researcher or a platform.

## Registration
None for anonymous use, which is the normal mode. A business owner claims a listing from its report page (for example https://directindex.org/r/belcanto.pt); the claim is confirmed by email, not by an agent credential. API keys come with the agency plan (https://directindex.org/agency) and are issued by a person; there is no self-service provisioning endpoint.

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous", "api_key"],
    "anonymous": { "credential_types_supported": ["none"] },
    "api_key": { "credential_types_supported": ["bearer"], "header": "Authorization", "scheme": "Bearer", "format": "di_live_ followed by 32 hex characters", "obtain": "https://directindex.org/agency", "raises": "scan limit only" },
    "claim_uri": "https://directindex.org/scan",
    "skill": "https://directindex.org/.well-known/agent-skills/scan-website/SKILL.md"
  }
}
```

## Credentials and limits
Reads are free and unlimited, with or without a key. New scans are limited to 30 per hour per client address without a key. With a key, sent as `Authorization: Bearer di_live_...` on /api/* or /mcp, new scans are counted per key at the key's own limit (300 an hour on the agency plan) and the call is attributed to the key in our logs; nothing else changes. A revoked or malformed key is ignored and the request is treated as anonymous. Endpoints under /admin are private and not for agents.

## Related metadata
- OAuth Protected Resource Metadata: https://directindex.org/.well-known/oauth-protected-resource (declares the MCP resource; no authorization server is required)
- API catalog: https://directindex.org/.well-known/api-catalog
- MCP server card: https://directindex.org/.well-known/mcp/server-card.json
- A2A agent card: https://directindex.org/.well-known/agent-card.json