# Auth.md — Authentication and agent access

`https://aprixity.run` publishes public website content and read-only article endpoints. They require no authentication. The main site is not an OAuth protected resource and does not advertise an issuer, token endpoint, client registration, or agent credentials.

## Public, unauthenticated access

- `GET https://aprixity.run/api/knowledge/articles` returns the published article index.
- `GET https://aprixity.run/api/knowledge/articles/{slug}` returns one article with all available translations. It does not accept a locale filter.
- `GET https://aprixity.run/api/aeo/articles/{slug}?locale={locale}` returns its answer-first representation.
- Successful canonical prerenders advertise a direct `.md` sibling and support `Accept: text/markdown` on the canonical URL.

These surfaces are read-only. Content publication and lead data are outside the public agent contract.

## Protected Sanierungs-Check MCP

The separate Sanierungs-Check service is OAuth-protected. Discover its current authentication contract from the service itself:

- Protected resource metadata: https://sanierung-mcp.aprixity.run/.well-known/oauth-protected-resource
- OAuth authorization server metadata: https://sanierung-mcp.aprixity.run/.well-known/oauth-authorization-server
- MCP endpoint: https://sanierung-mcp.aprixity.run/mcp

Clients must follow the scopes, grant types, and endpoints returned by those live metadata documents. Aprixity does not claim dynamic agent registration beyond the capabilities they advertise.

## Discovery documents

- API catalog: https://aprixity.run/.well-known/api-catalog
- OpenAPI: https://aprixity.run/openapi.json
- Developer resources (German): https://aprixity.run/de/developers
- Developer resources (English): https://aprixity.run/en/developers
- MCP server card: https://aprixity.run/.well-known/mcp/server-card.json
- Content access skill: https://aprixity.run/.well-known/agent-skills/aprixity-content/SKILL.md