# Saaskly agent authentication

*Last updated 2026-08-28 · canonical: https://saaskly.com/auth.md*

This document follows the auth.md walkthrough structure (https://workos.com/auth-md) so an agent can decide, step by step, how to get credentials. The short version: **you don't need any**. Everything Saaskly exposes to agents is public, read-only, and free.

## Discover

- REST API: `https://saaskly.com/api/` — OpenAPI at `https://saaskly.com/openapi.json`, catalog at `https://saaskly.com/.well-known/api-catalog`.
- MCP server: `https://saaskly.com/mcp` (alias `https://saaskly.com/.well-known/mcp`), Streamable HTTP, stateless. Server card: `https://saaskly.com/.well-known/mcp/server-card.json`.
- Markdown mirrors: append `.md` to any page URL. Index: `https://saaskly.com/llms.txt`.
- There is no `/.well-known/oauth-authorization-server`, `/.well-known/oauth-protected-resource` or `agent_auth` metadata because no endpoint is protected. Requests carry no `WWW-Authenticate` challenge.

## Pick a method

| Surface | Method | Notes |
| --- | --- | --- |
| REST read endpoints (`GET /api/providers`, `/api/categories`, `/api/articles`, `/api/pages`) | none | Published content only; drafts are filtered by the access layer |
| MCP tools and resources | none | All tools are annotated `readOnlyHint: true` |
| Markdown mirrors, `llms.txt`, well-known manifests | none | Plain GET |
| Write endpoints (`POST/PATCH/DELETE /api/*`, `/admin`) | staff login only | Not available to agents; there is no self-serve registration (`register_uri`) and no `identity_assertion` / `id-jag` flow |

## Register

Nothing to register. No API key, no OAuth client, no sign-up. If a future write surface (the vendor portal) opens to agents it will be announced on `https://saaskly.com/developers` with its own auth.md section; until then any request for credentials is unnecessary.

## Claim

Not applicable — there is no credential to claim. Requests are anonymous. Identify your agent honestly in the `User-Agent` header (product name, contact URL) so we can reach you if traffic patterns need attention.

## Use the credential

Send requests with no `Authorization` header. Example:

```bash
curl -s "https://saaskly.com/api/providers?where[category][equals]=voip&sort=-overallRating&limit=5&depth=0"
curl -s -X POST https://saaskly.com/mcp -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

If you do send an `Authorization` header it is ignored on read endpoints.

## Errors

- `401` / `403` from `/api/*`: you hit a staff-only collection (`users`) or a write method. The body is JSON: `{"errors":[{"message":"..."}]}`. There is no credential that would make it succeed — use the read endpoints instead.
- `404` JSON from `/api/*`, or a Markdown 404 from `*.md`, means the slug does not exist; list endpoints (or the MCP `list_*` tools) return valid slugs.
- `405` on `GET /mcp`: the server is stateless; use POST.
- `429` with `Retry-After` may be introduced in future for abusive traffic; back off as instructed.

## Revocation

There is nothing to revoke. Access can only be withdrawn for everyone (by taking an endpoint down) or per client via IP/User-Agent blocking for abuse, in which case requests return `403` with a JSON body explaining why and a contact address.

## Terms

Automated use is permitted under the Terms of Use, section 4 (`https://saaskly.com/terms.md`): attribute Saaskly and link to the source page; scores are editorial opinion; bulk republishing and model training need written permission. Contact: help@saaskly.com.