# Auth.md

## Authentication — Minus To Free

> Machine-readable agent registration and authentication guide.
> Last updated: 2026-09-17

## Summary

- Site: https://minustofree.com
- Contact: ziadnajebreel@gmail.com
- Public (unauthenticated) access: read-only content, calculators, MCP tools.
- Authenticated access: user dashboard, intake questionnaire history, admin tools.

## Public endpoints (no authentication)

| Endpoint | Purpose |
| --- | --- |
| `https://minustofree.com/api/public/mcp` | MCP server (streamable HTTP, JSON-RPC 2.0) |
| `https://minustofree.com/openapi.json` | OpenAPI 3.1 description of public endpoints |
| `https://minustofree.com/.well-known/api-catalog` | RFC 9727 API catalog |
| `https://minustofree.com/.well-known/ard.json` | Agentic Resource Discovery manifest |
| `https://minustofree.com/sitemap.xml` | Sitemap |

No API key is required for these. Please stay under 60 requests per minute.

## Authenticated access (OAuth 2.1 / OIDC)

Identity is issued by the site's managed auth provider.

- Issuer: `https://yigizbpqbnuukoaywmot.supabase.co/auth/v1`
- Discovery: `https://minustofree.com/.well-known/openid-configuration`
- Authorization server metadata: `https://minustofree.com/.well-known/oauth-authorization-server`
- Protected resource metadata: `https://minustofree.com/.well-known/oauth-protected-resource`
- Flow: authorization code + PKCE (S256)
- Scopes: `openid`, `email`, `profile`
- Token presentation: `Authorization: Bearer <access_token>`

### Agent registration

1. Fetch `https://minustofree.com/.well-known/oauth-protected-resource` to learn the issuer.
2. Fetch the issuer discovery document for the authorization and token endpoints.
3. Register a client via dynamic client registration when enabled, or email
   ziadnajebreel@gmail.com with the agent name, purpose and redirect URIs.
4. Run the authorization-code + PKCE flow on behalf of the end user.

## Usage policy

- Personal data of site users must never be scraped or stored by agents.
- Content may be used to answer user questions with attribution to https://minustofree.com.
- Content may **not** be used for training generative models (see `/robots.txt` content signals).
- Nothing on this site is regulated financial advice.