# Agent authentication for Tawak

Tawak has no authenticated machine interface. There are no credentials to obtain,
no OAuth authorization server, no token endpoint, and no API keys. This file
documents that posture explicitly so that an agent does not spend turns hunting
for a discovery document that is intentionally absent.

## Summary

| Property | Value |
| --- | --- |
| Authentication required | No |
| Identity types supported | `anonymous` |
| Credential registration endpoint | None |
| OAuth protected resource metadata | Not published, because there is no protected resource |
| OAuth authorization server metadata | Not published, because there is no authorization server |
| API keys | None issued |
| `WWW-Authenticate` challenges | Not returned, because no endpoint is protected |

## Discover

Everything an agent needs is public and unauthenticated. The machine-readable
entry points are:

- [llms.txt](https://www.tawak.app/llms.txt): short index for language models.
- [llms.md](https://www.tawak.app/llms.md): full markdown overview.
- [Product MCP server card](https://www.tawak.app/mcp/server-card): the endpoint is POST `https://www.tawak.app/mcp`.
- [Documentation MCP server card](https://www.tawak.app/mcp-docs/server-card): the endpoint is POST `https://www.tawak.app/mcp-docs`.
- [index.md](https://www.tawak.app/index.md): the homepage in markdown.
- [/.well-known/agent-skills/index.json](https://www.tawak.app/.well-known/agent-skills/index.json): published skills.
- [/.well-known/agent-card.json](https://www.tawak.app/.well-known/agent-card.json): A2A agent card.
- [/.well-known/ard.json](https://www.tawak.app/.well-known/ard.json): Agentic Resource Discovery manifest.
- [/.well-known/api-catalog](https://www.tawak.app/.well-known/api-catalog): RFC 9727 API catalog.

## Pick a method

There is exactly one method: **anonymous access**. Send a plain `GET` request.
No `Authorization` header is expected, and sending one has no effect.

Because there is no credential flow, the `identity_assertion` and `service_auth`
identity types from the WorkOS `auth.md` specification do not apply. In
particular, there is no `identity_endpoint`, no `claim_endpoint`, no
`events_endpoint`, and no ID-JAG (`urn:ietf:params:oauth:token-type:id-jag`)
assertion exchange. Any document claiming otherwise is not published by Tawak.

## Register

Not applicable. No client registration, no dynamic client registration, no
developer portal, and no key issuance.

## Claim

Not applicable. There is nothing to claim and no token to mint.

## Exchange

Not applicable. There is no token exchange or refresh flow.

## Use the access token

Not applicable. Requests to this site are unauthenticated. Send `GET` and read
the response body.

## Errors

- `404` is returned for paths that do not exist. The 404 body links back to the
  sitemap and to `llms.txt` so a client can recover.
- No endpoint returns `401`, because no endpoint is protected. A `401` with a
  `WWW-Authenticate` header would be misleading and is deliberately not emitted.
- Rate limiting on the static site is handled by the hosting platform.

## Revocation

Not applicable. With no credentials issued there is nothing to revoke. If you
believe a Tawak-branded credential has been issued to you by some other party, it
is not official. Report it to
[tawakapp@gmail.com](mailto:tawakapp@gmail.com).

## Reference

This document follows the structure of the WorkOS auth.md specification:
<https://github.com/workos/auth.md>.