---
title: "Authentication — iammatthias.com"
description: "How agents authenticate with iammatthias.com: they don't. Everything is public and anonymous."
canonical: https://iammatthias.com/auth.md
last-updated: 2026-08-21
---
# Authentication

There is no authentication. Every endpoint, page, feed, and MCP tool on iammatthias.com is public and anonymous.

## Discover

Machine-readable descriptions of this site live at:

- https://iammatthias.com/.well-known/oauth-protected-resource — RFC 9728 metadata, declaring no authorization servers and no required scopes
- https://iammatthias.com/.well-known/ai-catalog.json — every agentic resource this site publishes
- https://iammatthias.com/openapi.json — the HTTP API surface
- https://iammatthias.com/.well-known/mcp/server-card.json — the MCP server and its tools

## Pick a method

None to pick. Send a plain request. Do not send an `Authorization` header; it is ignored.

```
curl https://iammatthias.com/api/search.json?q=cloudflare
```

## Register

No registration. There is no `register_uri` because there is no credential to register for. Identity type: `anonymous`.

## Claim and use a credential

Not applicable — no credential exists to claim, present, or refresh.

## Errors

Requests fail only on their own merits, never on identity. Errors are RFC 9457 problem documents (`application/problem+json`) carrying `code`, `detail`, and a `resolution` string that says how to fix and retry. You will never receive a `401` or a `WWW-Authenticate` challenge from this site.

## Revocation

Nothing to revoke.

## Etiquette

Identify yourself with a descriptive `User-Agent`. Prefer `/llms-full.txt` (one request for the whole corpus) over crawling page by page. Cache by the `cid` field — it is a content hash, so an unchanged `cid` means unchanged bytes.