# auth.md

How an AI agent obtains credentials for **OTA News** (https://www.ota-news.com).

## Do you need credentials at all?

No, if you only want to read. Every article, OTA profile, comparison and
glossary entry is public and unauthenticated:

- `GET https://www.ota-news.com/llms.txt` — full site index as markdown
- `GET https://www.ota-news.com/{ota}/{article}.md` — any article as markdown
- `Accept: text/markdown` on any page — that page as markdown
- `GET https://www.ota-news.com/feed` — RSS

Read traffic is rate limited to roughly 60 requests per minute per IP.
Send a descriptive `User-Agent`. See `https://www.ota-news.com/robots.txt` for the content
signals that govern reuse.

Yes, if you want to **write** — create or edit articles, OTA profiles, PR
links or glossary terms. That happens over MCP and requires a human-approved
OAuth grant.

## Discovery documents

| Document | URL |
|---|---|
| Protected resource metadata | `https://www.ota-news.com/.well-known/oauth-protected-resource` |
| Authorization server metadata | `https://www.ota-news.com/.well-known/oauth-authorization-server` |
| MCP server card | `https://www.ota-news.com/.well-known/mcp/server-card.json` |
| API catalog | `https://www.ota-news.com/.well-known/api-catalog` |
| Published skills | `https://www.ota-news.com/.well-known/agent-skills/index.json` |

The authorization server metadata carries an `agent_auth` block naming the
registration endpoint and the flows below. Treat these documents as
authoritative rather than probing endpoints by hand.

## Registering an agent

OTA News supports RFC 7591 dynamic client registration:

```http
POST https://www.ota-news.com/oauth/register
Content-Type: application/json

{
  "client_name": "Your agent's name",
  "redirect_uris": ["https://your-agent.example/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_method": "none"
}
```

You get back a `client_id` (and a `client_secret` for confidential clients).
Registration alone grants no access — it only identifies your agent.

## Getting a token

Authorization code with PKCE (`S256`), which requires an OTA News account
holder to approve the grant in their browser:

1. Send the operator to `https://www.ota-news.com/oauth/authorize` with your `client_id`,
   `redirect_uri`, `response_type=code`, `code_challenge` and
   `code_challenge_method=S256`.
2. A human signs in and approves.
3. Exchange the returned code at `https://www.ota-news.com/oauth/token` for an access token
   and refresh token.

For headless agents on a device without a browser, use the device
authorization flow at `https://www.ota-news.com/oauth/device/code`.

There is no anonymous, self-service or machine-only path to write access. A
person is always in the loop.

## Using the credential

Send the access token as a bearer token on every MCP request:

```http
POST https://www.ota-news.com/mcp
Authorization: Bearer {access_token}
Content-Type: application/json
```

Bearer tokens go in the `Authorization` header only — never in a query
string. Refresh with the `refresh_token` grant at `https://www.ota-news.com/oauth/token`
rather than re-running the approval flow.

## What you can do with it

The MCP server at `https://www.ota-news.com/mcp` exposes read tools (`list-otas`,
`list-categories`, `list-articles`, `get-article`, `list-glossary-terms`,
`get-glossary-term`, `list-pr-links`) and write tools (`create-article`,
`update-article`, `create-ota`, `update-ota-profile`,
`create-glossary-term`, `create-pr-link`, `update-pr-link`,
`delete-pr-link`).

Publishing an article is outward-facing: it generates a summary and
embedding, computes related articles and posts to X. Create drafts and let a
human publish.

## Revocation

Account holders revoke agent access from the OTA News admin at
`https://www.ota-news.com/cockpit/mcp-tokens`. A revoked token starts failing immediately —
stop retrying and ask the operator to re-authorise. Report a leaked or
misused credential to hello@ota-news.com.

## Contact

hello@ota-news.com — HolidayHero B.V., Amsterdam, the Netherlands.