# Agent authentication on jointhestudentlife.com

How an agent gets access to The Student Life, and exactly which credentials exist. The short answer: none are needed. Every agent surface is open and keyless. This file lives at `/auth.md`, the discovery path from the WorkOS auth.md spec (https://github.com/workos/auth.md). We do not run the registration machinery of that spec because nothing here is behind a login; this file documents what we implement and what we deliberately do not.

## Discover

- MCP server: `https://jointhestudentlife.com/mcp` (Streamable HTTP). Server card: `https://jointhestudentlife.com/mcp/server-card`.
- Docs MCP server: `https://jointhestudentlife.com/mcp/docs`. Server card: `https://jointhestudentlife.com/mcp/docs/server-card`.
- REST API: `https://jointhestudentlife.com/api/v1`, described by `https://jointhestudentlife.com/openapi.json`.
- A2A agent: `https://jointhestudentlife.com/a2a`, card at `https://jointhestudentlife.com/.well-known/agent-card.json`.
- Catalog of everything above: `https://jointhestudentlife.com/.well-known/ard.json` (same document at `/.well-known/ai-catalog.json`) and `https://jointhestudentlife.com/.well-known/api-catalog`.
- There is no `/.well-known/oauth-protected-resource` and no `/.well-known/oauth-authorization-server`, because no endpoint on this site is OAuth protected.

## Pick a method

- **No credential.** This is the only method. Call any endpoint above directly. No API key, no account, no signup and no payment.

## Register

Nothing to register. There is no client registration, no API key form and no developer account.

## Claim

Nothing to claim. Agents act anonymously. When an agent sends something on behalf of a student (a waiting list sign up or a message to the team), the student's own name and email travel in the request body and our team replies to that email address.

## Exchange

There is no token exchange. Do not send an `Authorization` header; it is ignored.

## Use the access token

There is no access token. Send requests as they are:

```
curl -s https://jointhestudentlife.com/api/v1/events?city=berlin
curl -s https://jointhestudentlife.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

## Errors

- REST errors are JSON: `{"error":{"code":"not_found","message":"..."}}` with a matching HTTP status (400, 404, 405, 429, 500).
- MCP errors are JSON-RPC errors with a `code` and `message` (for example `-32602` for an unknown tool or invalid arguments, `-32601` for an unknown method).
- No endpoint asks for credentials, so you never get a 401. A `403` with `forbidden_origin` means a browser page on another site tried to send a message or sign up; send it from your server instead. A `429` means a rate limit; wait for `Retry-After`.

## Revocation

Nothing to revoke. To ask us to delete data a student sent through an agent (for example a waiting list sign up), email support@jointhestudentlife.com from that address. See https://jointhestudentlife.com/privacy-policy.

## Limits and fair use

- REST reads are cached at the edge for about a minute and are safe to call often within the rate limits (see https://jointhestudentlife.com/developers#limits).
- Write tools (`join_halloween_waitlist`, `send_message_to_team`, `POST /api/contact`) reach real people. Only call them with the student's consent and their own details. They are limited to a few calls per minute and accept `dry_run: true` for testing.