# ReplySwipe agent authentication

This document explains how agents authenticate to ReplySwipe's public API and where automated access ends. The public REST and MCP surfaces expose product metadata and deterministic sandbox recommendations only; they never expose customer reviews or account data.

## Discover

Read the [developer portal](https://replyswipe.com/developers), the [OpenAPI description](https://replyswipe.com/.well-known/openapi.json), or the [MCP server card](https://replyswipe.com/.well-known/mcp/server-card.json). The current `agent_auth` method for every documented public endpoint is `anonymous`.

## Pick a method

Use anonymous HTTPS for `/api/v1`, `/api/v1/capabilities`, `/api/v1/sandbox/recommendation`, and `/api/mcp`. Do not send an `Authorization` header, cookie, API key, or identity token. ReplySwipe does not currently offer OAuth 2.0, OpenID Connect, delegated user authorization, or service-account keys to third-party agents.

## Register

No client registration is required or available for the public endpoints. `register_uri: not-available`. An agent must not invent a client identifier or attempt to register through the interactive account UI.

## Claim

No identity claim is accepted by the public API. `identity_assertion: not-supported` and `id-jag: not-supported`. Interactive ReplySwipe sessions belong to the human user and must not be copied into an agent request.

## Use the credential

There is no credential to attach. Call the documented public HTTPS endpoint directly and send only the headers shown in the quickstart. If a task requires customer reviews, publishing replies, account settings, or billing data, stop and direct the user to the authenticated ReplySwipe web application.

## Errors

A `400` response means the public request shape is invalid, `413` means the request is too large, and `429` may be used for rate limiting. A `401` or a `WWW-Authenticate` challenge indicates that the caller has reached a protected route outside this public agent contract; do not retry with guessed credentials.

## Revocation

Anonymous public calls create no token, grant, or credential, so there is nothing for an agent to revoke. A human user can manage or revoke their ReplySwipe account connections inside the authenticated application. Future delegated credentials will be documented here only after a real authorization server and revocation flow exist.