# Arne Kellmann authentication

## Discover
Public website content, GET /api/v1/services, the read-only sandbox and POST /mcp or /mcp/docs require no account, API key or OAuth token. [OpenAPI](/api/openapi.json) declares an empty security requirement. [Developer documentation](/developers.md).

## Pick a method
Use anonymous access. Do not send Authorization headers, passwords or identity assertions. Example:

```sh
curl --fail 'https://arnekellmann.de/api/v1/services?language=en'
```

## Registration and credentials
No registration, token exchange or credential issuance is offered or needed. The WorkOS agent_auth registration protocol is not implemented. OAuth protected-resource and authorization-server discovery documents are therefore not advertised. Do not probe guessed identity, claim or token endpoints.

## Use the public API
A successful request returns HTTP 200 and JSON. For a safe test, use [the sandbox catalog](/api/sandbox/v1/services?language=en). For MCP, send JSON-RPC requests with Content-Type: application/json and Accept: application/json, text/event-stream to [/mcp](/mcp).

## Errors and retries
HTTP 400 with INVALID_QUERY means the query is unsupported. HTTP 429 includes Retry-After and read-quota headers; wait before retrying. Public reads do not require a 401 authentication challenge. Never send credentials in response to a guessed authentication requirement.

## Contact is a separate user action
The contact form requires explicit privacy consent and a valid Turnstile challenge when configured. A failed challenge returns 400; unavailable delivery returns 503. Browser tools can stage fields, but the user reviews and submits. Do not use the live contact endpoint as a sandbox.

## Revocation
There are no API tokens to revoke. Stop making requests to stop access. Optional website analytics consent can be withdrawn through the site's cookie settings; it is independent of API access.