# auth.md - Thirumalesh Pinninti Portfolio

This document describes access procedures for programmatic AI agents.

## No authentication required

Every API on this origin is **public and read-only**. There is no
authorization server, no registration step, and no credential to obtain.
Requests that send an `Authorization` header are not rejected, but the header
is ignored.

Agents should call the endpoints directly:

| Endpoint | Purpose |
| --- | --- |
| `/api/profile` | Profile data as JSON |
| `/api/mcp` | Model Context Protocol server (JSON-RPC 2.0) |
| `/api/openapi.json` | OpenAPI description of the public API |
| `/api/health` | Liveness check |
| `/llms.txt`, `/llms-full.txt` | Plain-text context for language models |
| `/.well-known/mcp/server-card.json` | MCP server card |
| `/.well-known/agent-skills/index.json` | Published agent skills |
| `/.well-known/ard.json` | ARD capability manifest |
| `/.well-known/ai-catalog.json` | Same manifest, AI Catalog path |
| `/.well-known/poppy.json` | Personal Agent Protocol discovery (website-only) |
| `/.well-known/oauth-protected-resource` | RFC 9728 resource metadata |

Any page also returns Markdown instead of HTML when requested with
`Accept: text/markdown`.

## Rate limits

None enforced. Please be reasonable; `robots.txt` asks for a 2 second
crawl delay.