# auth.md

# Form 5500 Search auth.md

This site is a **public data resource**, not an agent-account platform.
Form 5500 filings are public U.S. Department of Labor records. Agents and
crawlers can read pages and the documented read APIs **without registering**.

## Audience

- **Agents / crawlers:** public HTML, markdown (`Accept: text/markdown`),
  `GET /api/search`, `GET /api/suggest`, `GET /api/health`, and MCP `/mcp`.
- **Humans:** optional Google or email sign-in at https://form5500search.com/login for Pro
  features (contact unlocks, CSV exports). That flow is Supabase Auth. It is
  not an RFC 7591 agent registration endpoint.

## Registration

There is **no** `POST /agent/auth` and no dynamic client registration.
Do not probe registration URLs — they do not exist, and a scanner that POSTs
would be creating nothing useful.

If a human needs a Pro session: open https://form5500search.com/login, complete Google or
email OTP, then send the session cookie. Agents should not do this.

## Credentials

Public read: none.
Pro (human): session cookie from `/login`. Send as `Cookie` on subsequent
requests. No bearer API keys are issued today.

## Discovery

- Protected-resource metadata: https://form5500search.com/.well-known/oauth-protected-resource
- Authorization-server metadata: https://form5500search.com/.well-known/oauth-authorization-server
- API catalog: https://form5500search.com/.well-known/api-catalog
- MCP: https://form5500search.com/mcp