# auth.md — julianleiss.com

_Last update: 2026-08-25 · canonical: https://julianleiss.com/auth.md_

> Agent-facing walkthrough in the [auth.md](https://workos.com/auth-md) format. Short version: **no credential is required**. Every endpoint on this domain is public, read-only and anonymous. There is nothing to register for, claim, or revoke.

## Discover

- Protected-resource metadata (RFC 9728): `https://julianleiss.com/.well-known/oauth-protected-resource` — declares the resource and that `bearer_methods_supported` is empty (no bearer token is ever required).
- There is **no** `/.well-known/oauth-authorization-server` and no `agent_auth` block, because no authorization server exists. No endpoint returns `401` or a `WWW-Authenticate` challenge.
- Resources: HTML/markdown pages, `/mcp` and `/mcp/docs` (MCP Streamable HTTP), `/ask` (NLWeb), `/a2a` (A2A JSON-RPC), feeds and `.well-known` catalogs. See `/agent.md`.

## Pick a method

The only supported identity type is **anonymous**. `identity_assertion` (ID-JAG, verified email) is not needed and not accepted — there are no user accounts, so there is no user to bind an agent to.

## Register

Skip. No `register_uri`. Send requests directly; the CORS policy is `*` and rate limiting is the CDN's default.

## Claim

Skip. No `claim_uri`, no one-time codes, no claim emails. Nothing on this site is owned by an agent or a user.

## Use the credential

There is no credential. Call endpoints plainly:

```http
POST /mcp HTTP/1.1
Host: julianleiss.com
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"tools/list"}
```

Do **not** send `Authorization` headers; they are ignored.

## Errors

- `400` — malformed JSON-RPC / NLWeb request.
- `404` — unknown path (markdown body at `/404.md`).
- `405` — method not allowed on a function endpoint.
- `429` — CDN rate limit; back off and retry with `Retry-After`.
- Never `401`/`403`: if you receive one, you are not talking to julianleiss.com.

## Revocation

Nothing to revoke: no keys, tokens or sessions are issued (`revocation_uri` does not exist). MCP sessions are stateless per request.

## Contact

Human contact and hiring happen by email — `hello@leiss.site` — not through an API. See `/pricing.md` and `/contact.md`.