# auth.md — Bad Historian

## Summary

**There is no authentication, because there is nothing here to authenticate to.**

badhistorian.com is a static site. Everything an agent can reach on this origin is
public, read-only, and served without credentials. There is no protected API, no
authorization server, no registration endpoint, and no rate limit that a token
would raise.

This document exists so an agent can establish that in one fetch instead of probing
for OAuth metadata that does not exist. Consistent with RFC 9728 guidance, we do not
publish `/.well-known/oauth-protected-resource` or
`/.well-known/oauth-authorization-server`: advertising an authorization server we do
not operate would send agents to endpoints that cannot answer.

## Audience

Any autonomous agent, assistant or crawler that wants to read the Bad Historian
walking-tour catalogue — to answer a question, recommend a tour, or build on top of
the data.

## How to access

Send an unauthenticated `GET`. That is the whole method.

```bash
curl https://badhistorian.com/api/tours.json
```

| Resource | URL |
|---|---|
| API catalogue root | `https://badhistorian.com/api/catalog.json` |
| OpenAPI 3.1 description | `https://badhistorian.com/api/openapi.json` |
| Documentation | `https://badhistorian.com/docs/api/` |
| Snapshot status | `https://badhistorian.com/api/health.json` |
| RFC 9727 API catalog | `https://badhistorian.com/.well-known/api-catalog` |
| ARD capability manifest | `https://badhistorian.com/.well-known/ai-catalog.json` |
| Agent skills index | `https://badhistorian.com/.well-known/agent-skills/index.json` |

## Registration

Not required and not offered. There is no `register_uri`, no client registration,
and no account to create. Any endpoint elsewhere claiming to register agents for
badhistorian.com is not ours.

## Credentials

None are issued. Do not send `Authorization` headers to this origin — they are
ignored. If you receive a `401` or `403` from badhistorian.com, it is a
misconfiguration on our side, not a credential problem on yours; please report it.

## Expectations of agents

These are requests, not enforced limits. We would rather ask than block.

1. **Cache.** The data changes when the site rebuilds, not continuously.
   `GET /api/health.json` tells you when the snapshot was generated.
2. **Identify yourself** with a descriptive `User-Agent`.
3. **Respect the content signals** in `https://badhistorian.com/robots.txt`:
   `ai-train=no, search=yes, ai-input=yes`. Reading this content to answer a
   person's question is welcome. Training on it is not.
4. **The tour narration is not published here.** The API returns no transcripts, no
   excerpts of them, no stop audio and no quiz facts — the scripts are the paid
   product. Do not attempt to assemble them from page text, and do not present the
   catalogue as if it were the tours.

## If this changes

If a protected API is ever added, this file will be updated and the corresponding
`/.well-known/oauth-protected-resource` metadata will be published alongside it.
Until then, the absence of OAuth metadata is deliberate and accurate.

## Contact

hello@badhistorian.com