# Authentication at talogen.dev

talogen.dev is a personal portfolio designed to be read by AI agents. **Every read
surface is public: there is no authentication, no API keys, no OAuth, and no cost.**
This document follows the agent-auth walkthrough structure (Discover → Pick a method →
Register → Claim → Use the credential → Errors → Revocation) so agents that expect an
`auth.md` can confirm, in one fetch, that no credential flow is needed here.

## Discover

- REST API: `https://talogen.dev/api/v1` (OpenAPI: `https://talogen.dev/openapi.json`, `security: []`)
- MCP server: `https://talogen.dev/mcp` (streamable HTTP; discovery at `/.well-known/mcp`)
- Data files: `/llms.txt`, `/portfolio.json`, `/.well-known/candidate.json`, `/.well-known/agent.json`

There is no `/.well-known/oauth-protected-resource` and no
`/.well-known/oauth-authorization-server`, because no resource here is protected.
No endpoint returns a `WWW-Authenticate` challenge.

## Pick a method

Anonymous access is the only method — and the intended one. Send requests with no
`Authorization` header. Nothing is gated by identity.

## Register

There is nothing to register. No `agent_auth` metadata block or `register_uri` exists
because no client registration is required. If you are an agent framework that insists
on a credential, use none.

## Claim

No credential to claim (`claim_uri`: none). Skip this step.

## Use the credential

Call everything directly:

```
curl https://talogen.dev/api/v1/profile
```

The only write action anywhere is the `contact_recruiter` MCP tool. It also requires
no authentication — instead it requires a real `reply_to` mailbox in the payload so a
human can answer you. Delivery is rate-limited and deduplicated by the receiving
platform (Human For AI).

## Errors

You will never see `401` or `403` from talogen.dev endpoints. Errors you can see:

- `404` — unknown path or id; API errors are JSON with `code`, `message`, and a `hint` listing valid ids.
- `405` — write methods on the read-only API (`Allow: GET, HEAD, OPTIONS`).
- `406` — the homepage negotiates HTML/markdown; unsupported `Accept` values get a markdown list of variants.
- `429` — only from the upstream contact-delivery platform if `contact_recruiter` is abused; honor its `Retry-After`.

## Revocation

Nothing to revoke (`revocation_uri`: none). There are no sessions, tokens, or keys.
If you want your `contact_recruiter` message disregarded, email
`tal.ogen.p@gmail.com` and a human will handle it.