# Authentication for Presspool

Presspool's public record is readable without an account, an API key, or an OAuth access token. The HTML pages, the Markdown twins, the JSON feeds, the read API at https://presspool.ai/api/v1, and the MCP server at https://presspool.ai/mcp all answer unauthenticated GET requests.

## Discover

An agent finds the read API from https://presspool.ai/.well-known/api-catalog, the OpenAPI description at https://presspool.ai/openapi.json, and the documentation at https://presspool.ai/api. The MCP server card is at https://presspool.ai/mcp/server-card. Protected-resource metadata at https://presspool.ai/.well-known/oauth-protected-resource names the resource https://presspool.ai/api/v1 and lists no authorization server, because none is required.

## Pick a method

Send no credential. Do not send an Authorization header. Presspool does not publish an authorization server, and it does not use agent_auth, an identity_endpoint, identity_assertion, service_auth, or id-jag. Public reads are not challenged with WWW-Authenticate.

## Register

There is nothing to register. Presspool does not run a client-registration endpoint.

## Claim

There is nothing to claim. Presspool does not run a claim endpoint.

## Exchange

There is no token endpoint and no access token to exchange. A request with no Authorization header is already authorized to read the public record.

## Use the access_token

Do not send an access token. `GET https://presspool.ai/api/v1/weeks` with no Authorization header is a complete request. The same is true of the other GET endpoints in the OpenAPI description, the JSON feeds, and the MCP `tools/call` methods.

## Errors

Unknown paths under `/api/v1` return `application/problem+json` with `code`, `detail`, and `resolution`. A missing record uses `not_found`. A malformed identifier uses `invalid_request`. A method other than GET, HEAD, or OPTIONS uses `method_not_allowed`. None of these is an authentication failure, and none asks the caller to obtain a token.

## Revocation

There are no credentials to revoke. Stop calling the endpoint when the task is done.