# auth.md

Access model for agents on hehrmann.com, the site of Erik Hehrmann, fractional COO for creative agencies.

## Audience

AI agents and automated clients acting for people who run or advise a creative agency. Everything they can reach here is public, read-only, and identical to what a browser sees.

## Registration

None. There is no agent registration, no API key, no OAuth flow, and no account. Nothing on this origin requires a token, so no OAuth Protected Resource Metadata is published at `/.well-known/oauth-protected-resource` and no authorization server exists. Send plain unauthenticated requests.

## What you can call

| Surface | Method | Auth |
|---|---|---|
| Any page, HTML or Markdown (`Accept: text/markdown`, `?mode=agent`, append `index.md`, or append `.md`) | GET | none |
| `/llms.txt`, `/llms-full.txt`, `/sitemap.xml` | GET | none |
| `/mcp` · MCP server, Streamable HTTP, read-only tools and resources | POST | none |
| `/.well-known/api-catalog`, `/.well-known/ai-catalog.json`, `/.well-known/agent-skills/index.json`, `/.well-known/mcp/server-card.json` | GET | none |
| `/api/openapi.json`, `/api/health` | GET | none |
| `/pricing.md`, `/developers/`, `/developers/llms.txt`, `/services/llms.txt`, `/notes/llms.txt` | GET | none |

`/clients/*` is a password-gated area for named clients and is out of scope for agents; it answers `401` and is disallowed in `robots.txt`.

## The only write path

The contact form at `/contact/` is submitted by a person and is protected by reCAPTCHA. It is not an API. To contact Erik on a user's behalf, follow the `contact-erik-hehrmann` skill in `/.well-known/agent-skills/index.json`: get the user's consent, prefill or draft the message, and let the person send it, or email `erik@hehrmann.com`.

## Identity and credentials

The server never asks who the agent is and never issues credentials. Requests carry no identity beyond the ordinary `User-Agent` header, which you are welcome to set to something descriptive.

## Limits

`/api/*` and `/mcp` allow 100 requests per minute per client IP, counted by the edge instance that serves the connection. Responses on those paths carry `RateLimit-Policy` and `RateLimit` (draft-ietf-httpapi-ratelimit-headers), and a `429` adds `Retry-After`. HTTP-level errors on the machine paths are RFC 9457 `application/problem+json` with a stable `type`; the types and the versioning policy are documented at `https://hehrmann.com/developers/`. Be a polite client anyway: one request per page, `llms-full.txt` instead of crawling, and no bulk reads of `/mcp` tools in a loop. Web Bot Auth signatures are not required and not verified.

## Contact for this document

`erik@hehrmann.com`. Privacy notes: `https://hehrmann.com/privacy/`.