# Authentication for Justine Meyer

> How an agent gets access to this site. Short version: everything you can read is open, and there are no API keys to obtain.

## Discover

Start from these, in this order:

- [`/llms.txt`](https://justinemeyer.com/llms.txt) — what this site holds, and when it is worth reading.
- [`/openapi.json`](https://justinemeyer.com/openapi.json) — every HTTP endpoint, its parameters, and its error shape. Its root `security: []` is the machine-readable statement of what this document says in prose: no authentication is required.
- [`/.well-known/mcp.json`](https://justinemeyer.com/.well-known/mcp.json) — the MCP server, its transport, and its tools. Its `authentication.type` is `none`.
- [`/.well-known/api-catalog`](https://justinemeyer.com/.well-known/api-catalog) — every machine-readable document here, as a linkset.

There is no `/.well-known/oauth-authorization-server` and no `/.well-known/oauth-protected-resource` on this host. That is not an omission: this site runs no authorization server and exposes no protected resource, so publishing either would point you at something that does not exist.

## Pick a method

**Reading — no credential.** Every read surface on this site is anonymous: the HTML pages, the `.md` twins, `llms.txt`, `llms-full.txt`, the OpenAPI document, and the MCP server. Send no `Authorization` header. You will not receive a `401`, because there is nothing here to be unauthorized for.

**Writing — not available.** This site exposes no endpoint that changes anything. There is no method to pick.

## Register

There is no registration step and no `register_uri`. No account, client id, or client secret exists to be issued, and nothing on this site records who is calling it beyond an ordinary request log.

## Claim a credential

Nothing to claim. There is no `claim_uri`.

## Use the credential

For reads, send an ordinary request. Two headers are worth setting:

- `Accept: text/markdown` on any page URL, if you would rather have Markdown than HTML.
- `Accept: application/json` if you want errors as JSON rather than as an HTML error page.
- A descriptive `User-Agent`. Nothing is gated on it, but it is what shows up in this site's request log, and an identifiable agent is a welcome one.

## Errors

Every error from this site is JSON when you ask for JSON, with the same shape throughout:

```json
{ "code": "rest_forbidden", "message": "...", "data": { "status": 403 } }
```

Match on `code`, not on `message`. `data.status` repeats the HTTP status.

- `401` — not used. No endpoint here challenges for credentials, so you will not see a `WWW-Authenticate: Bearer` header and there is no `resource_metadata` URL to follow.
- `404` — wrong URL. The body carries a `links` array pointing at this site's index, sitemap and catalog, so a wrong guess is recoverable in one more request.
- `429` — you are being rate limited. Read `RateLimit-Reset` and `Retry-After` and wait.

## Revocation

There is no `revocation_uri`, because there is no persistent credential to revoke. Nothing is issued.

Access can still be withdrawn from this end — `robots.txt` states this site's crawler policy, and it is the document to read before assuming a bulk crawl is welcome.