# auth.md — SpotDrop

Short version: **the public booking API needs no authentication, and everything
that does need authentication is not machine-accessible today.**

## Open to agents — no credentials

These endpoints are public. No API key, no token, no registration, no OAuth. They
are rate limited per IP, the same as the public booking form.

| Endpoint | Purpose |
| --- | --- |
| `GET /api/company/{slug}/appointment-services` | Bookable services of a business |
| `GET /api/company/{slug}/slots` | Free time slots for one date |
| `POST /api/company/{slug}/appointments` | Create a booking |
| `GET /api/health` | Service health |
| `POST /api/mcp` | MCP server, read-only tools over the same data |

Documentation: https://www.spotdrop.si/docs/api · OpenAPI: https://www.spotdrop.si/openapi.json

Please identify your client in the `User-Agent` header. Book only on behalf of a
person who asked for that specific slot; do not create speculative or duplicate
appointments.

## Closed — human login only

Business dashboard endpoints (appointment lists, customers, schedules, employees,
billing, analytics; anything under `/api/company/{slug}/...` beyond the table above,
plus `/api/admin/*`) authenticate with a first-party session cookie. A business owner
gets one by receiving a magic link at their business email address, or by signing in
with a password or Google.

There is no agent registration, no client credentials flow and no API key issuance
for these endpoints. That is deliberate: they expose other people's customer data —
names, phone numbers and appointment history of the businesses' clients — and
SpotDrop does not hand that to an automated third party.

Because there is no authorization server, this site publishes no
`/.well-known/oauth-authorization-server`, `/.well-known/openid-configuration` or
`/.well-known/oauth-protected-resource` metadata. Their absence is the accurate
answer, not an oversight: an agent that discovered such a document here would only
be able to fail against it.

## Want authenticated access?

If you are building something that genuinely needs owner-level access — a POS
integration, a calendar sync, a partner product — write to info@spotdrop.si with what
you need and which businesses have asked for it. Access is granted per business, by
its owner.

## Related

- Terms of service: https://www.spotdrop.si/terms
- Privacy policy: https://www.spotdrop.si/privacy
- Capability manifest: https://www.spotdrop.si/.well-known/ai-catalog.json