# EcoAloha authentication (auth.md)

Short version: there is nothing to authenticate. The REST API (https://ecoaloha.com/api/v1) and the MCP server (https://ecoaloha.com/mcp) are public and keyless. No OAuth 2.0, no API key, no account. Rate limits are the only control.

## Discover

Metadata lives at /.well-known/api-catalog (RFC 9727), /.well-known/mcp/server-card.json and /openapi.json. OpenAPI declares `security: []`. There is no /.well-known/oauth-authorization-server because no authorization server exists.

## Pick

Pick the interface: MCP (Streamable HTTP, JSON-RPC 2.0) or REST under /api/v1. Both expose the same tools and the same limits.

## Register

No client registration. Do not send Authorization, API-key or Cookie headers; they are ignored.

## Claim

No scopes or claims. Every client has the same read access. The only write is create_share_list (public shortlist, 30-day expiry, private deletion token in the response).

## Exchange

No token exchange. Send requests directly.

## Use

- Edge: 300 requests per 10 seconds per client IP on /api/* and /mcp.
- Live partner data: 60 requests per minute and 20 requests per hour per client IP. Every /api/v1 and /mcp response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Policy headers.
- Live-data calls return 503 AGENT_ACCESS_NOT_APPROVED until Viator approval; discovery calls always work.
- /admin and /api/v1/admin are protected by Cloudflare Access and are not public.
- Sandbox: send `X-Sandbox: true` (or ?sandbox=true) to get fixture data without quota, partner calls or writes. See https://ecoaloha.com/developers#sandbox

## Errors

REST errors are application/problem+json (RFC 9457) with type, title, status, detail and a machine-readable `code`; a legacy `error` object is kept. A 429 carries Retry-After. MCP returns JSON-RPC errors for protocol faults and `isError` tool results for tool faults.

## Revocation

Nothing to revoke. Abusive clients are blocked at the edge by IP. Delete a share list with its deletion token (DELETE /api/v1/share/{id}).

## Versioning

The public API lives under /api/v1. Breaking changes ship under a new path version. Deprecated versions announce a Sunset header at least 90 days before removal.

Contact: hello@ecoaloha.com. Guide: https://ecoaloha.com/for-agents. Developer portal: https://ecoaloha.com/developers