# Authentication for agents

EbooksDepository requires **no authentication for anything it offers
agents**. Every public surface — the search API, the Markdown documents,
the JSON-LD feeds, the catalog pages — is anonymous, read-only and free.
This document follows the structure of the WorkOS auth.md draft
(https://workos.com/auth-md) so an agent looking for an `agent_auth` block
learns quickly that there is nothing to configure.

## Discover

There is no `/.well-known/oauth-protected-resource` and no
`/.well-known/oauth-authorization-server` on this host, because no resource
here is OAuth-protected. API responses never send a `WWW-Authenticate`
challenge: a request that stays inside the rate limit is simply answered.

## Pick a method

The only method is `anonymous`. In WorkOS auth.md terms:
`identity_types_supported` would contain exactly `anonymous`, and there is
no `identity_assertion` support — we verify no asserted identities and
accept no `id-jag` (identity-assertion JWT authorization grant) tokens.

## Register

There is no `register_uri`. No client registration exists, self-serve or
reviewed. If you can send HTTP, you are registered.

## Claim

Nothing to claim: no token endpoint, no `claim_uri`, no credential is ever
issued.

## Use the credential

Send plain requests. Identify your agent honestly in `User-Agent` — known
AI agents are explicitly welcomed in robots.txt and get Markdown responses
on HTML pages. Respect the rate limits in https://ebooksdepository.com/api.md (60 requests/min
on the search API; standard `RateLimit` headers on every response).

## Errors

API errors are RFC 9457 `application/problem+json` documents with a stable
`code` — see https://ebooksdepository.com/api.md. A `429` carries `Retry-After`. On the public
agent surface you will never see a `401` for a missing credential, because
none exists; a `401` with code `unauthenticated` only ever comes from the
private publishing endpoints, which are not offered to agents.

## Revocation

Nothing to revoke. If a client abuses the service, the edge rate limiter
throttles it; there is no credential to invalidate.