# auth.md

You are an agent. **MKRST's API needs no registration, key or token.** There is no OAuth server, no token endpoint and no claim flow, so there is no OAuth or protected-resource metadata to discover. Do not look for any. Everything below is the whole access model.

Host: `https://api.mkrst.co`. Machine-readable spec: [openapi.json](https://api.mkrst.co/openapi.json). MCP server: `https://api.mkrst.co/mcp`.

## 1. Reads: anonymous

Send plain requests with no `Authorization` header.

```http
GET https://api.mkrst.co/v1/pricing
```

- Covers every `GET /v1/*` route and every read tool on the MCP server.
- Rate limited per IP: 60 requests per minute. Every response carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`. On `429`, wait `Retry-After` seconds.
- Data is public content from mkrst.co, cached for up to 5 minutes.

## 2. Enquiries: anonymous, rate limited, with a sandbox

`POST /v1/enquiries` (and the `submit_enquiry` MCP tool) sends a new-business enquiry to MKRST. It is also anonymous. It is protected by:

- Rate limit: 5 real submissions per hour per IP.
- Validation: name, need and your agent name are required, plus an email or phone.
- Consent flag: a real submission must have `user_confirmed: true`. **Set it only after the human user has explicitly agreed to send this enquiry.** Never submit on a user's behalf without that.

A real submission creates a lead in MKRST's CRM and emails the studio. A person replies to the user directly.

### Sandbox: dry run

Send `"dry_run": true` to validate and preview exactly what would be sent. A dry run creates nothing and sends nothing, needs no `user_confirmed`, and is limited to 30 per minute per IP. Use it to show the user the enquiry before asking for their OK.

```http
POST https://api.mkrst.co/v1/enquiries
Content-Type: application/json

{ "name": "Sam Lee", "email": "sam@example.com", "need": "Brand identity for a seed-stage fintech", "agent_name": "Example Assistant", "dry_run": true }
```

## 3. Errors

Every error is JSON with the right HTTP status:

```json
{ "error": { "code": "validation_error", "message": "…", "hint": "what to do next" } }
```

Common codes: `not_found` (404), `validation_error` / `confirmation_required` (422), `rate_limited` (429), `upstream_unavailable` / `crm_unavailable` / `email_failed` (502). If a submission returns an error, **do not tell the user it was delivered**. A `502` with `email_failed` means the CRM has the enquiry but the notification email failed; retrying is safe and will not duplicate the lead.

## 4. Not supported

No API keys, OAuth, user accounts, webhooks or write access other than enquiries. If that changes, this file and the OpenAPI spec will change with it.

## Contact

studio@mkrst.co, +61 7 3556 5329 (Mon to Fri, 9am to 5pm Brisbane time).