# auth.md

_Last updated: 2026-08_

## Summary

None of the machine-readable surfaces on vitalpeptides.app require authentication:

- REST API (`https://vitalpeptides.app/api/v1/openapi.json`)
- MCP server (`https://vitalpeptides.app/mcp`)
- A2A agent (`https://vitalpeptides.app/.well-known/agent-card.json`, `https://vitalpeptides.app/a2a`)

Every endpoint they expose is read-only public catalog data — products, kits,
blog posts, prices in MXN — the same information already rendered on the
site's own pages. There is no API key, no OAuth flow, no registration step,
and no user/order/account data reachable through any of them.

## What this means for a client

- Skip any authorization handshake. A request to `/mcp`, `/a2a`, or any
  `https://vitalpeptides.app/api/v1/*` path needs no bearer token, cookie, or
  signature.
- `https://vitalpeptides.app/.well-known/oauth-protected-resource` correctly 404s —
  there is no OAuth-protected resource on this origin to describe.
- If a future endpoint here ever needs write access (placing an order,
  reading account data), it will carry real authentication and this document
  will be updated to describe it. Until then, absence of auth is the answer,
  not an oversight.

## Rate limits

No published limit. Respect each response's `Cache-Control` header instead
of polling — the full catalog changes in minutes, not seconds.