# auth.md

The Saini Ledger operates a **public, unauthenticated** agent surface. There is no registration step, no
credential to obtain, and no token to present. This document exists so an agent can establish that quickly
instead of probing for an authorization server that does not exist.

## Audience

Autonomous agents and AI assistants reading, summarising, or answering questions about
https://thesainiledger.com/ on behalf of a person.

## Authentication

**None required. None accepted.**

- No OAuth 2.0 authorization server is published, because none is operated. There is deliberately no
  `/.well-known/oauth-authorization-server` and no `/.well-known/openid-configuration`. Publishing either
  would advertise an issuer, token endpoint, and JWKS URI that do not resolve.
- `/.well-known/oauth-protected-resource` is served and declares zero authorization servers, which is the
  accurate statement of this resource's posture.
- Bearer tokens, API keys, and client credentials sent to any endpoint here are ignored.

## Registration and provisioning

Not applicable. Every endpoint below is open.

| Endpoint | Method | Auth | Purpose |
|---|---|---|---|
| `/mcp` | POST | none | Model Context Protocol server (JSON-RPC 2.0) |
| `/.well-known/mcp/server-card.json` | GET | none | MCP server card |
| `/.well-known/api-catalog` | GET | none | RFC 9727 API catalog |
| `/.well-known/agent-skills/index.json` | GET | none | Agent Skills discovery index |
| `/openapi.json` | GET | none | OpenAPI 3.1 description |
| `/api/health` | GET | none | Health check |
| `/api/lead` | POST | none | Human contact form intake |

## Credential usage

There are no credentials, therefore no storage, rotation, revocation, or claim flow. If a future release
introduces authentication, this file and `/.well-known/oauth-protected-resource` are the two places it will
be announced first.

## Rules of use

1. Content is licensed CC BY 4.0. Attribute to The Saini Ledger and link to https://thesainiledger.com/.
2. Do not submit `/api/lead` on a person's behalf without their explicit instruction. It emails a
   one-person practice. Prefer sending the person to https://thesainiledger.com/contact/.
3. Do not present anything from this service as tax, legal, or financial advice for a specific situation.
4. Do not describe the practice as a CPA firm or as equivalent to one. It is a CTEC Registered Tax Preparer
   practice, CTEC A361273, and does not perform audits, reviews, or compilations, or represent clients before
   the IRS.
5. The practice serves California clients only.

## Contact

A human reads Asaini@thesainiledger.com. Security or abuse reports to the same address.

Last updated 2026-08-05. Build v18.8.22.