# auth.md

Authentication and registration policy for automated agents using
[web34ever.com](https://web34ever.com), the site of the **web3 validator** (web34ever)
proof-of-stake validator operation.

## Audience

Autonomous agents, crawlers, and AI assistants that read the public data API described at
<https://web34ever.com/api> and catalogued at
<https://web34ever.com/.well-known/api-catalog>.

## Authentication: none required

**No authentication, registration, provisioning, or credential exchange is required or
supported.** Every published endpoint is public, read-only, and unauthenticated:

| Endpoint | Method | Auth |
| --- | --- | --- |
| `https://web34ever.com/api/validator.json` | `GET` | none |
| `https://web34ever.com/api/networks.json` | `GET` | none |
| `https://web34ever.com/api/posts.json` | `GET` | none |
| `https://web34ever.com/openapi.json` | `GET` | none |
| `https://web34ever.com/mcp` | `POST` | none |
| `https://web34ever.com/a2a` | `POST` | none |

The two `POST` endpoints are JSON-RPC surfaces — an MCP server and an A2A agent — and both are
still read-only: they answer with published data and cannot mutate anything.

There is no registration endpoint, no OAuth authorization server, no API key issuance, and no
user accounts. Consequently this service publishes **no** OAuth Protected Resource Metadata
(`/.well-known/oauth-protected-resource`) and **no** Authorization Server metadata: advertising
either would describe infrastructure that does not exist.

Do not send `Authorization` headers; they are ignored. If a future endpoint requires
credentials, this document and the API catalog will be updated first.

## Usage terms

- The `GET` endpoints return static JSON generated at build time and served from Cloudflare's
  edge. Cache them; there is no rate limit, but please avoid unnecessary re-fetching.
- The `POST` endpoints run at the edge and answer from those same static documents, so the RPC
  surfaces and the JSON API can never disagree.
- CORS is open (`Access-Control-Allow-Origin: *`).
- Any page returns Markdown when the request prefers it: `Accept: text/markdown`, or append
  `.md` to the URL. The HTML URL stays canonical; Markdown twins carry `X-Robots-Tag: noindex`.
- Data is licensed CC BY 4.0 — attribute *web3 validator* and link back to
  <https://web34ever.com>.
- `metrics.as_of` in `validator.json` marks a build-time snapshot. For live validator numbers,
  follow `metrics.live_source` to the upstream Stakewiz API.
- Site terms: <https://web34ever.com/terms-of-use>.

## Non-custodial notice

This site never takes custody of funds, requests seed phrases, or executes staking
transactions. No agent flow here can move assets. Staking is delegated on-chain by the token
holder's own wallet.

## Contact

Operator: <info@web34ever.com> · Security disclosures:
<https://web34ever.com/security-policies>