# Charaliva auth.md

This document describes the current third-party AI agent authentication boundary for Charaliva.

## Current status

- Charaliva does not currently offer third-party agent registration.
- Charaliva does not currently publish OAuth/OIDC client discovery for external agents.
- Charaliva does not currently expose MCP tools or authenticated agent actions.
- Public agents may read public discovery documents and public browsing surfaces only.

## Public unauthenticated discovery

- Homepage: https://charaliva.com/
- robots.txt: https://charaliva.com/robots.txt
- Sitemap: https://charaliva.com/sitemap.xml
- LLM summary: https://charaliva.com/llms.txt
- LLM full context: https://charaliva.com/llms-full.txt
- API catalog: https://charaliva.com/.well-known/api-catalog
- MCP server card: https://charaliva.com/.well-known/mcp/server-card.json
- Agent skills index: https://charaliva.com/.well-known/agent-skills/index.json

## Public read API boundary

The public API catalog advertises discovery and read endpoints only. It must not be interpreted as permission to perform authenticated user actions.

- GET /api/v2/feed: Public character and story feed used by discovery pages.
- GET /api/v2/characters/search: Public character search used by the search page.
- GET /api/v2/tags/popular: Public popular tag list used by discovery filters.
- GET /api/v2/rankings/:type: Public ranking data for popular AI characters and stories.
- GET /api/v2/health: Public API health probe.

## Protected actions

Private chat, user profile, billing, creator dashboard, uploads, admin operations, and write APIs require first-party Charaliva web authentication. Third-party agents should not request user credentials or attempt to automate protected actions unless Charaliva publishes a future explicit authorization flow.

## Future metadata

If Charaliva later supports third-party agent authentication or remote MCP tools, it will publish accurate OAuth/OIDC, OAuth Protected Resource, or authenticated MCP metadata at the standard well-known locations.