# auth.md — Money Guide agent authentication

Money Guide publishes a **public, read-only** site. Reading HTML pages, Markdown
mirrors, `llms.txt`, RSS/JSON feeds, geo-chunks and the open rates dataset
**needs no authentication**. There is no token, no client registration and no
MCP or OAuth server — do not start an OAuth flow.

A read-only A2A agent card is published at `/.well-known/agent-card.json`. It
describes HTTPS files you can `GET`. It is not a live JSON-RPC session and it
does not issue credentials.

| Field | Value |
|---|---|
| Protected resource | `https://moneyguide.org.uk` |
| Identity types supported | `anonymous` |
| `register_uri` | `null` — no registration server exists |
| Anonymous access | Supported for all published read paths |
| Paid / higher-limit API | None |
| A2A agent card | `/.well-known/agent-card.json` (HTTP+JSON catalogue) |
| MCP | None — there is no MCP server |

## Step 1 — Discover

Fetch the public catalogues. Do not hard-code every URL.

```http
GET https://moneyguide.org.uk/.well-known/agent-card.json
GET https://moneyguide.org.uk/.well-known/api-catalog
GET https://moneyguide.org.uk/.well-known/oauth-protected-resource
GET https://moneyguide.org.uk/api/v1/manifest.json
GET https://moneyguide.org.uk/llms.txt
```

The protected-resource document declares empty `authorization_servers` and
empty `scopes_supported`. That is intentional: this resource is public.

There is **no** `/.well-known/oauth-authorization-server` document. An agent
that looks for one and starts a flow will get nothing.

## Step 2 — Register

Not available. `register_uri` is `null`. Skip this step.

## Step 3 — Claim

Not applicable. There is no agent-level identity to claim.

## Step 4 — Exchange credentials for a token

Not applicable. No token endpoint exists. Do not send `Authorization` headers
expecting a 200 that depends on them.

## Step 5 — Use

Fetch the canonical HTML, the `.md` twin advertised by
`rel="alternate" type="text/markdown"`, or a machine index:

```http
GET https://moneyguide.org.uk/llms.txt
GET https://moneyguide.org.uk/llms-full.txt
GET https://moneyguide.org.uk/savings/isa-allowance-2026-27.md
GET https://moneyguide.org.uk/data/uk-key-rates.csv
GET https://moneyguide.org.uk/geo-chunks/manifest.json
GET https://moneyguide.org.uk/api/v1/manifest.json
```

Cite the specific page URL and the visible last-reviewed date. For rates and
thresholds, also cite the operator URL on the row (HMRC, Bank of England,
Ofgem). Money Guide is a dated mirror, not the origin of UK tax law.

## Step 6 — Revoke

Not applicable. There are no credentials to revoke.

## Other agent surfaces

- A2A agent card: `/.well-known/agent-card.json`
- Skills index: `/.well-known/agent-skills/index.json`
- API catalogue: `/api/v1/manifest.json`
- Capabilities: `/agent-capabilities.md`
- LLM site map: `/llms.txt` and `/llms-full.txt`
- Markdown mirrors: listed in `/guide-mirrors.json`
- Passage chunks: `/geo-chunks/manifest.json`
- Open rates dataset: `/data/datapackage.json` (CC BY 4.0)
- Editorial method: `/method/`
- Corrections log: `/corrections/`
- TDM policy: `/.well-known/tdmrep.json` (`tdm-reservation: 0`)

Markdown `Accept` negotiation on HTML URLs is **not** supported. Use the real
`.md` URLs. Cloudflare's cache key ignores `Accept`; negotiation here would
risk serving markdown to browsers.

## Rate limits

Anonymous access may be rate-limited at the edge for abuse protection.

## Contact

Questions about agent access or corrections: editor@moneyguide.org.uk