# Sinder auth.md

> Agent registration and authentication guide for the Sinder public API
> (https://sinder.ae). Follows the Auth.md convention (https://workos.com/auth-md).

## Who this is for

AI agents and automated clients that want to use Sinder's read-only
analytics/business API at `/api/gpt-action/` (REST) or
`/api/gpt-action/mcp` (Model Context Protocol, Streamable HTTP).

Most Sinder content needs **no authentication at all** — see
"Public surfaces" below before requesting credentials.

## Public surfaces (no credentials required)

- `/llms.txt` and `/llms-full.txt` — markdown site digest
- `/markdown/*` — per-page markdown twins (also served via
  `Accept: text/markdown` content negotiation on any HTML page)
- `/.well-known/agent.json`, `/.well-known/agents.json`,
  `/.well-known/mcp.json`, `/.well-known/webmcp.json` — agent discovery
- `/openapi.json` — public OpenAPI 3.1 spec
- `/api/legal/documents/:id` — public legal documents

## Protected resource

- REST: `https://sinder.ae/api/gpt-action/*` (spec: `https://sinder.ae/api/gpt-action/openapi.json`)
- MCP: `POST https://sinder.ae/api/gpt-action/mcp`
- Data: aggregate crawler/analytics/business metrics only — no PII.

## Registration (manual, email-verified)

Automated credential issuance is **not** offered. To obtain an API key:

1. Email **socials@sinder.ae** from your organisation's domain with:
   - who you are and what agent/product will call the API,
   - which endpoints you need,
   - expected request volume.
2. A Sinder admin reviews the request and, if approved, issues an API key
   out-of-band to your verified email address.
3. Keys can be revoked at any time by the Sinder admin team; contact the
   same address for rotation or revocation.

## Authentication

Send the issued key on every request, either as a Bearer token or an
`X-API-Key` header:

```http
GET /api/gpt-action/analytics/sessions HTTP/1.1
Host: sinder.ae
Authorization: Bearer <YOUR_API_KEY>
```

```http
X-API-Key: <YOUR_API_KEY>
```

- Comparison is constant-time; missing/invalid keys receive `401` with a
  `WWW-Authenticate` header referencing the protected-resource metadata.
- If no key is configured server-side the API fails closed with `503`.
- Requests are rate-limited; keys are scoped read-only (`gpt-action:read`).

## OAuth discovery metadata

- Protected Resource Metadata (RFC 9728): `https://sinder.ae/.well-known/oauth-protected-resource`
- Authorization Server Metadata (RFC 8414): `https://sinder.ae/.well-known/oauth-authorization-server`

Note: `grant_types_supported` is empty by design — there is no automated
authorization/token flow. The `/oauth/authorize` and `/oauth/token`
endpoints exist and return standard OAuth error responses directing
clients to this document.