# auth.md

For AI agents and automated crawlers evaluating access to anahana.com.

## Summary

All published content on anahana.com (Anahana Wellness Inc.) is public —
articles, calculators, tools, and section indexes across all 24 languages.
No credential is ever required to read the website itself.

The MCP endpoint at [`https://www.anahana.com/mcp`](https://www.anahana.com/mcp)
has two access tiers over the **same read-only tools**:

| Tier | How | Rate limit |
| --- | --- | --- |
| Anonymous | Just call it — no credentials | 30 requests/min per IP |
| Registered | OAuth 2.1 Bearer token (registration is open and instant) | 120 requests/min per client |

Registration unlocks nothing except the higher rate limit and a stable,
revocable client identity. There is no private data, no write access, and
no user account system behind this server.

## Agent registration

Registration is open **dynamic client registration (RFC 7591)** — no
human approval, no pre-existing credential, no waiting.

```json
"agent_auth": {
  "skill": "https://www.anahana.com/auth.md",
  "register_uri": "https://www.anahana.com/mcp/register",
  "identity_types_supported": ["anonymous"],
  "anonymous": { "credential_types_supported": ["oauth2_client"] }
}
```

This block is also served live inside
[`/.well-known/oauth-authorization-server`](/.well-known/oauth-authorization-server).

### Endpoints

- **Registration (`register_uri`)**: `POST https://www.anahana.com/mcp/register`
- **Authorization**: `GET https://www.anahana.com/mcp/authorize`
- **Token**: `POST https://www.anahana.com/mcp/token` (also handles RFC 7009 revocation)
- **Discovery**: [`/.well-known/oauth-authorization-server`](/.well-known/oauth-authorization-server)
  (RFC 8414) and [`/.well-known/oauth-protected-resource`](/.well-known/oauth-protected-resource)
  (RFC 9728)

### Flow (OAuth 2.1 authorization code + PKCE)

Standard MCP client auth works out of the box — point your MCP client at
`https://www.anahana.com/mcp` and it will discover everything above. For
hand-rolled agents:

1. **Register**: `POST /mcp/register` with JSON client metadata
   (`client_name`, `redirect_uris`, `grant_types:
   ["authorization_code","refresh_token"]`, `response_types: ["code"]`,
   and your `token_endpoint_auth_method` — `client_secret_post`,
   `client_secret_basic`, or `none` for public clients using PKCE only).
   Returns `client_id` (and `client_secret` for confidential clients).
2. **Authorize**: `GET /mcp/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256&state=...`.
   There is no consent screen and no login — nothing user-owned is being
   delegated, so every valid request from a registered client is approved
   automatically and answered with a `302` to your `redirect_uri`
   carrying `code` and `state`. Headless agents can read the `Location`
   header directly instead of following it.
3. **Exchange**: `POST /mcp/token` with `grant_type=authorization_code`,
   the `code`, your `redirect_uri`, client credentials, and the PKCE
   `code_verifier`. Returns a Bearer `access_token` (expires in 1 hour)
   plus a `refresh_token`.
4. **Call**: `POST https://www.anahana.com/mcp` with
   `Authorization: Bearer <access_token>` (Streamable HTTP, MCP).

### Scopes

- `read:content` — the only scope. Read access to the same public
  articles and calculators listed at
  [`/.well-known/agent-skills/index.json`](/.well-known/agent-skills/index.json).
  Requested scopes are normalized to this.

### Rate limits

- Anonymous: **30 requests/minute per IP**. Responses over the limit are
  `429` with a `Retry-After` header.
- Registered: **120 requests/minute per client_id**, independent of IP.
- Need more? Email us (below).

## No auth anywhere else

Everything outside `/mcp` remains completely unauthenticated. If a normal
page request returns a 401 or 403, that is a bug or a bot-management
false positive, not an access gate.

## MCP discovery

Server card: [`/.well-known/mcp/server-card.json`](/.well-known/mcp/server-card.json).
Skills: [`/.well-known/agent-skills/index.json`](/.well-known/agent-skills/index.json).

## Contact

team@anahana.com