# Authenticating with assetfra

**Short version: everything an agent can do here needs no credentials, and everything that
needs credentials is not available to agents.**

## Reading — open, no registration

No API key, no token, no sign-up. These are public:

- `GET https://assetfra.com/v1/listings` — every visible raise
- `GET https://assetfra.com/v1/originators` — the businesses raising
- `GET https://assetfra.com/v1/health` — liveness
- `POST https://assetfra.com/v1/mcp` — MCP over streamable HTTP (read-only tools)
- `https://assetfra.com/llms.txt`, `https://assetfra.com/openapi.json`, `https://assetfra.com/.well-known/ai-catalog.json`

Please identify your agent in a `User-Agent` header. There is no enforced rate limit on the
read endpoints today; be reasonable and it will stay that way.

## Writing — a human signature, and no agent path

Subscribing to a raise, listing on the secondary desk, binding a payout wallet and every
other action that moves money requires **Sign-In-With-Ethereum**: a signature from the
private key of the wallet that owns the funds, produced by a person in a browser, exchanged
for a session cookie.

This is not an oversight, and it is not a gap waiting for an OAuth flow. Money here is held
in self-custody. A credential that let software spend on someone's behalf would be exactly
the thing the design refuses to create, and an agent holding it would be a better target than
the wallet itself. If you are building an agent that helps someone invest, the useful shape
is: read the market through the endpoints above, form a recommendation, and hand the person a
link to the deal so they sign it themselves.

## There is no OAuth or OIDC server

`/.well-known/openid-configuration` and `/.well-known/oauth-authorization-server` are not
published, because no authorization server exists to describe. Nothing here issues bearer
tokens, so `/.well-known/oauth-protected-resource` would have no issuer to name either.
Treat their absence as the answer, not as a discovery failure — there is nothing to register
for and nothing to fetch a token from.

If that changes, this document changes with it, and the well-known endpoints will appear.

## Agent registration

Not required. There is nothing to register for: read access is open to everyone, and no
credential exists that would grant an agent more than that.

If you are running something at a scale where you would like us to know about it, or you need
data these endpoints do not expose, write to hello@assetfra.com and tell us what you are
building.

## Status

Binance Smart Chain testnet (BSC, chain 97). The dollar token is tUSDT on BSC — a different
asset from USDT on Ethereum or Tron. Nothing here has real value yet, and the data is test
data.