# benmilne.com auth.md

AI agents, LLM tool-use clients, and programmatic API consumers.

## Discover

Discover authentication requirements by probing these endpoints:

- OAuth Protected Resource metadata: `GET https://benmilne.com/.well-known/oauth-protected-resource`
- OAuth Authorization Server metadata: `GET https://benmilne.com/.well-known/oauth-authorization-server`
- OpenID Configuration: `GET https://benmilne.com/.well-known/openid-configuration`
- OpenAPI spec: `GET https://benmilne.com/openapi.json`
- MCP server card: `GET https://benmilne.com/.well-known/mcp/server-card.json`
- API documentation: `GET https://benmilne.com/api`

The `agent_auth` block in the OAuth Authorization Server metadata describes all supported registration and identity flows.

## Pick a method

| Method | Details |
|---|---|
| Anonymous | All endpoints accept unauthenticated requests. No API key, OAuth token, or session is required. |

All API endpoints, MCP tools, and content routes are **public and unauthenticated**.
The recommended method is anonymous access — no credentials needed.

## Register

No agent registration is required. The `register_uri` at https://benmilne.com/auth.md confirms public access.
Agents may begin calling the API or connecting via MCP immediately without provisioning credentials.
Registration at this URI grants anonymous public access automatically.

## Claim

No credential claim step is needed. All endpoints are public.
Agents that discover this auth.md can proceed directly to making API calls.

## Use the credential

No credential is required. Make requests directly:

```bash
curl https://benmilne.com/api/posts
curl -X POST https://benmilne.com/mcp -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
curl -X POST https://benmilne.com/graphql -H 'Content-Type: application/json' -d '{"query":"{ site { name } }"}'
```

All JSON API responses include `Access-Control-Allow-Origin: *` for cross-origin access.
Rate limit headers (`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`) are included on every response.

## Errors

| Status | Meaning |
|---|---|
| 200 | Success |
| 400 | Bad request (invalid parameters) |
| 401 | Invalid bearer token (remove the `Authorization` header — all endpoints are public) |
| 404 | Resource not found |
| 429 | Rate limited — retry after `Retry-After` seconds |

Error responses return JSON: `{ "error": "message" }`. GraphQL errors use `extensions.code` for typed error handling.

## Revocation

No credentials are issued, so no revocation is necessary.
There are no API keys, tokens, or sessions to invalidate.