# auth.md Authentication and identity for agents at sozai.app. **There is none, and there is nothing to authenticate.** | | | |---|---| | Identity type | `anonymous` | | `register_uri` | `null` | | `claim_uri` | `null` | | `revocation_uri` | `null` | | Authorization servers | none | | Scopes | none | ## What this means in practice Every machine-readable endpoint on this origin is public, keyless and CORS-open. No request to any of them writes anything, spends anything, or reads anything about a person. There is therefore no token to obtain, no account to register and no credential that could be stolen from you. - Data API: — CC BY 4.0, attribute SozAI with a link. - OpenAPI: - MCP server: `https://sozai.app/mcp` — JSON-RPC 2.0 over POST, Streamable HTTP, `authentication: none`. - A2A endpoint: `https://sozai.app/a2a` — `message/send`. - Markdown twin of any page: append `index.md` to its URL, or send `Accept: text/markdown`. - Protected Resource Metadata: — published with empty lists, so a client can tell "declared none" from "not published". ## The part that does require an account Transcribing a file beyond the free five-minute web preview happens inside the SozAI app on iOS, Android or macOS, against an account created there and billed through the App Store or Google Play. That is a product boundary, not an API with an undocumented key: **no server-side interface exists for a third party to submit a transcription job**, which is why there is no OAuth server here to describe. If that ever changes, this document and `/.well-known/oauth-protected-resource` change with it, in the same commit. ## Abuse and contact Rate limits apply per IP to the free web tools (10 YouTube transcripts an hour, 3 audio previews per device per day). They are not authentication and carry no identity. Questions: . Takedown requests: .