# auth.md — Wycord

**There is none, and none is required.**

The Wycord registry API is public, read-only and CORS-open. You do not need an API key, an
account, a token, or to register as an agent. Just call it.

```bash
curl "https://wycord.com/api/resources?category=apis&country=NG"
```

## Why there is no OAuth metadata here

Wycord deliberately does **not** publish `/.well-known/openid-configuration`,
`/.well-known/oauth-authorization-server` or `/.well-known/oauth-protected-resource`.

It has no authorization server and no token-protected resource, so those documents would
describe endpoints that do not exist. An agent that read them would start an auth flow and
fail. Their absence is the correct signal: **there is nothing to authenticate against.**

## What you can call

| Surface | Auth | Notes |
|---|---|---|
| `GET https://wycord.com/api/resources` | none | Read-only registry query |
| `POST https://wycord.com/api/mcp` | none | MCP, JSON-RPC 2.0, read-only tools |
| `GET https://wycord.com/openapi.json` | none | OpenAPI 3.1 contract |
| `GET https://wycord.com/llms.txt` | none | Compact site summary |
| `POST https://wycord.com/api/submit` | none | Suggest a resource. Rate-limited. Lands in a review queue, never published directly. |

## Limits and etiquette

- **Rate limiting is per-IP** on write endpoints (`/api/submit`, `/api/subscribe`). Reads are
  not currently rate-limited, but do not hammer them — this is a small independent registry.
- **Send a `User-Agent` that identifies your agent.** If you break something, we want to be
  able to tell you rather than block you.
- **Cache.** The registry changes on the order of days, not seconds. `last_verified` on each
  record tells you how fresh the underlying check is.
- Admin endpoints under `/api/admin/*` exist but are **not for third parties**. They are
  operator-only and are not part of the public contract.

## Discovery

- `https://wycord.com/.well-known/api-catalog` — every machine surface, in one RFC 9727 document
- `https://wycord.com/.well-known/mcp/server-card.json` — MCP server card
- `https://wycord.com/.well-known/agent-skills/index.json` — published agent skills
- `https://wycord.com/docs/api` — human-readable docs