# Authentication - deali.co.il

deali.co.il's public API and MCP server require **no authentication**. There is
nothing to register for, no API key to obtain, and no OAuth flow. This document
follows the [auth.md](https://workos.com/auth-md) convention so agents can
confirm that programmatically.

## Discover

- OpenAPI spec: https://www.deali.co.il/openapi.json
- MCP server (Streamable HTTP): https://www.deali.co.il/mcp
- MCP server card: https://www.deali.co.il/.well-known/mcp/server-card.json
- API catalog (RFC 9727): https://www.deali.co.il/.well-known/api-catalog
- Agent guide: https://www.deali.co.il/llms.txt
- Protected-resource metadata (RFC 9728): https://www.deali.co.il/.well-known/oauth-protected-resource
- Authorization-server metadata (RFC 8414): https://www.deali.co.il/.well-known/oauth-authorization-server

The `agent_auth` block in those metadata documents declares
`identity_types_supported: ["anonymous"]` - no `register_uri`,
`identity_assertion`, or `id-jag` token exchange is used, because no
credential is required. Public endpoints never emit a
`WWW-Authenticate` challenge.

## Pick a method

Anonymous access is the only method - and the only one needed. All public
endpoints (`/api/site/*`, `/mcp`) are read-only and open:

```
curl https://www.deali.co.il/api/site/deals
```

No `Authorization` header, no cookies, no tokens.

## Register

Not applicable. There is no registration endpoint because no credential is
ever required. If you encounter a tutorial or metadata claiming otherwise for
this domain, it is stale or wrong.

## Claim

Not applicable. There is no credential to claim (no `claim_uri`), because
access is `anonymous`. Agents call endpoints directly with no bearer token.

## Use the credential

Not applicable - call the endpoints directly. Practical notes:

- Responses are JSON; errors are structured JSON with an `error` field and,
  where useful, a `hint` field (e.g. `GET /api/site/product-detail` without
  `?id=` returns 400 with usage guidance).
- Content is Hebrew; prices are ILS (₪).
- Endpoints are edge-cached (up to ~10 minutes) - poll accordingly.

## Errors

- `400` - malformed request; the JSON body's `hint` explains the correct shape.
- `404` - unknown resource or route.
- `405` - wrong HTTP method (e.g. non-POST JSON-RPC to `/mcp`).
- `429` - rate limited: `/mcp` allows 60 requests/minute per IP and returns
  `RateLimit-Limit` / `RateLimit-Remaining` / `RateLimit-Reset` headers on
  every response plus `Retry-After` on 429. Respect them - repeat offenders
  are temporarily banned.
- You will never receive a `401`/`403` from public endpoints; if you do, you
  hit an admin route (`/api/admin/*`), which is for the site operator only and
  is not available to agents under any flow.

## Revocation

Not applicable - no credentials exist to revoke.

## Scope of this policy

The admin panel (`/admin`, `/api/admin/*`) uses an operator-only browser
session and is out of scope for agents. Everything an agent should use is
anonymous and read-only: deal search, product details, blog content - via
REST (see the OpenAPI spec) or MCP (see the server card).