# auth.md

Moveezi's public API needs no credentials. There is no signup, no API key, no
OAuth flow and no token to obtain. Every endpoint documented in
https://www.moveezi.com/openapi.json is public and read-only, except `POST /api/lead`, which
takes a sales enquiry and is also open. The MCP server at https://www.moveezi.com/mcp is
public too. If you are here to find out how to get a key: you do not need one,
go ahead and call it.

This document follows the [auth.md](https://github.com/workos/auth.md)
structure so an agent that expects those sections finds them. Each one says
what is true of this API rather than describing a flow that does not exist.

## Discover

There is nothing protected, so there is no protected-resource metadata to
fetch. `/.well-known/oauth-protected-resource` and
`/.well-known/oauth-authorization-server` are deliberately absent: publishing
them would advertise an authorization server that does not exist. No response
from this API carries a `WWW-Authenticate` header, because no response is a
401.

What to fetch instead, to learn what is here:

- https://www.moveezi.com/.well-known/ard.json - every agentic resource in one catalog
- https://www.moveezi.com/openapi.json - the API, typed, with an operationId per operation
- https://www.moveezi.com/.well-known/mcp.json - the MCP server manifest
- https://www.moveezi.com/llms.txt - what Moveezi is and when to reach for it

## Pick a method

`anonymous`. The auth.md profile defines this for services with no
pre-existing user context, which is this one. Do not attempt
`identity_assertion` or `service_auth`; there is no `agent_auth` block, no
`identity_endpoint`, no `claim_endpoint` and no `events_endpoint`, because
there is nothing for them to bind an agent to.

## Register

No registration. Send the request.

## Claim ceremony

None. There is no user session to bind an agent to, so there is no
`claim_token` and no `user_code` to present to anyone.

## Exchange the assertion

Not applicable. There is no assertion, no token endpoint, and no grant.

## Use the access_token

There is no access token. Send no `Authorization` header. Requests that carry
one are not rejected; the header is ignored.

Two headers do matter:

- `Idempotency-Key` on `POST /api/lead`. Retrying with the same key replays
  the first response for 24 hours instead of creating a second lead, and does
  not consume rate-limit budget. Replays are marked `Idempotency-Replayed: true`.
- `Accept: text/markdown` on any page URL returns markdown instead of HTML.

## Errors

Errors are JSON with an `error` string and a repeated `status`, never a
challenge. You will never see a 401 or a 403 from this API. The ones you can
see:

- `400` - malformed body, or a missing required field
- `404` - no such page or path, with a markdown body when you asked for markdown
- `422` - from the sandbox endpoint, meaning the payload would be rejected
- `429` - rate limited. Read `Retry-After` and the `RateLimit-*` headers and
  back off. Reads allow 120 requests per minute per IP;
  `POST /api/lead` allows 5 per hour per IP.
- `502` - the lead could not be recorded anywhere; use the chat on the website

## Revocation

Nothing to revoke. No credential is ever issued, so none can be withdrawn, and
there is no revocation endpoint or event stream.

## The authenticated API

Moveezi's tenant API, behind https://app.moveezi.com, is a different system: authenticated,
per-customer, versioned separately, and not documented here. It is not
reachable from anything in this document. If you need access to it, that is a
commercial conversation: sales@moveezi.com.