# auth.md — Cardrake agent access

Cardrake is a Pokémon TCG collection tracker. This document tells autonomous
agents, MCP clients and API consumers what they need in order to use it, and is
the authoritative answer on credentials.

**Short version: you need none.** Everything an agent can reach today is public,
anonymous and read-only.

## Audience

- MCP clients (ChatGPT, Claude, MCP Inspector, and anything else speaking
  streamable HTTP)
- Autonomous agents calling the REST API
- Crawlers and indexers building machine-readable catalogues

## No credentials required

| Surface | Auth |
|---|---|
| MCP server — `https://www.cardrake.com/api/mcp` | None |
| REST API — see [openapi.json](https://www.cardrake.com/openapi.json) | None |

There is **no registration endpoint, no client provisioning, no OAuth
authorization server and no API key issuance** for agents at this time. Do not
construct a registration flow against this host; requests to invent one will
404.

Use the `www` host. The apex redirects, and MCP clients do not reliably follow
redirects on POST.

## Rate limits

The MCP endpoint allows **600 requests per minute per
IP address**. Exceeding it returns HTTP `429` with a JSON-RPC error and
`Retry-After: 60`. Honour that header rather than retrying immediately.

The REST endpoints carry no application-level per-IP limit today; a CDN sits in
front of them and enforces its own. Please keep sustained traffic to roughly one
request per second and send a descriptive `User-Agent` that identifies your
agent, so we can tell you apart from abuse.

If you need materially more throughput than that, write to enquiries@cardrake.com rather
than working around the limit.

## What agents can and cannot reach

Available: the card catalogue, expansions, printed and master-set totals,
per-variant TCGPlayer market prices, and the Cardrake Chase Score.

Not available to any agent, at any tier: user accounts, collections, wishlists,
portfolios, and payment or subscription state. These require a signed-in browser
session, and no credential exists that would let an agent read them. Subscribing
is a human action completed at https://www.cardrake.com/upgrade.

## Roadmap — not shipped, do not build against this

Account linking over OAuth 2.1 is planned, which would let a consenting user
expose their own collection to an assistant. It has **no ETA and no published
endpoints**. When it ships it will be announced at
[https://www.cardrake.com/guides/chatgpt-plugin](https://www.cardrake.com/guides/chatgpt-plugin) and described by OAuth Protected
Resource Metadata at `/.well-known/oauth-protected-resource`, which does not
exist yet. Treat any implementation against this paragraph as premature.

## Machine-readable documents

| Document | Purpose |
|---|---|
| [/.well-known/api-catalog](https://www.cardrake.com/.well-known/api-catalog) | RFC 9727 catalogue of every interface |
| [/openapi.json](https://www.cardrake.com/openapi.json) | OpenAPI 3.1 description of the REST API |
| [https://www.cardrake.com/api/mcp/server-card](https://www.cardrake.com/api/mcp/server-card) | MCP server card (canonical) |
| [/.well-known/ai-catalog.json](https://www.cardrake.com/.well-known/ai-catalog.json) | Domain-level index of agent artifacts |
| [/.well-known/agent-skills/index.json](https://www.cardrake.com/.well-known/agent-skills/index.json) | Agent skills, with SHA-256 digests |
| [/guides/chatgpt-plugin](https://www.cardrake.com/guides/chatgpt-plugin) | Human-readable integration guide |
| [/robots.txt](https://www.cardrake.com/robots.txt) | Crawl policy |
| [/sitemap.xml](https://www.cardrake.com/sitemap.xml) | Page index |

## Using the data

Prices are TCGPlayer market values for raw, ungraded cards in USD, synced daily.
They are not graded comparables and not appraisals. Condition and exact variant
both change what a card is worth, so cite the variant.

Please attribute Cardrake and link the canonical URL returned with each result.
That is a request, not a licence grant.

## Privacy

What the MCP endpoint receives and logs is described at
[https://www.cardrake.com/privacy](https://www.cardrake.com/privacy). In short: no conversation content is stored,
and per-client analytics are keyed on a salted hash of the request IP rather than
the address itself.

## Contact

enquiries@cardrake.com