# auth.md for chan.dev

chan.dev is primarily a public content site. Public pages, feeds, and content APIs do not require authentication.

## Agent audience

Agents may read public content, request markdown responses with `Accept: text/markdown`, use the API catalog at `/.well-known/api-catalog`, inspect the OpenAPI document at `/openapi.json`, and use the public MCP endpoint at `/mcp`.

## Registration

chan.dev does not currently offer self-service agent registration, token issuance, or delegated agent credentials.

## Credentials

No bearer token is required for public content endpoints. Do not send secrets or user credentials to public content endpoints.

## Human dashboard

`/dashboard` is a private human dashboard. Sign in at https://auth.chan.dev/sign-in?service=chan. The shared auth service owns login, session validation and renewal, and logout. It uses the chan.dev Project's Production Web application. A current shared browser session grants immediate access without another login.

chan.dev keeps its dashboard access policy and retrieves only the public user profile over a private service binding. It does not issue or exchange tokens, decrypt sessions, or hold WorkOS credentials. Sign-out uses a same-origin POST and ends the shared session. The dashboard is not an agent API.

## Contact

For access questions, contact Michael Chan through the public links on https://chan.dev/about/.