# Agent authentication on initiable.com

Initiable's agent surfaces need **no credentials**. This file lives at the conventional `/auth.md` path (see the WorkOS auth.md proposal) so agents can confirm that quickly instead of probing for OAuth metadata.

## Discover

- REST API: `https://initiable.com/api/v1`, described by [https://initiable.com/openapi.json](https://initiable.com/openapi.json) with `security: []`.
- MCP servers: `https://initiable.com/mcp` and `https://initiable.com/mcp/docs` (Streamable HTTP). Server cards declare `authentication.required: false`.
- There is no `/.well-known/oauth-protected-resource` or `/.well-known/oauth-authorization-server`, because no Initiable endpoint is OAuth-protected.

## Pick a method

- **No credential.** Every endpoint, read and write. Just call it.
- There is no API key tier, OAuth flow, or agent registration.

## Use

- Send JSON with `Content-Type: application/json`. No `Authorization` header is needed; if you send one it is ignored.
- Writes (`POST https://initiable.com/api/v1/inquiries`, MCP `submit_inquiry`) are protected by rate limits instead of credentials: 5 inquiries per 10 minutes per IP.
- Use `"dry_run": true` to test writes without side effects, and an `Idempotency-Key` header to make retries safe.

## Errors

- `429 rate_limited`: wait for the `Retry-After` header.
- Endpoints never return `401` or `403` for missing credentials.

## Contact

Questions: [initiable.xyz@gmail.com](mailto:initiable.xyz@gmail.com).