# auth.md — Hardware Hunter Web Bot Auth

Direct account-scoped authentication model: agent operations use a personal
Bearer API key provisioned by the account holder, or pay-per-query via x402
for price intelligence.

## Authentication

### Public Endpoints (no authentication required)
- `/api/public/*` — public price data, hardware categories, blog content
- `/` and all marketing pages — HTML and markdown content for all agents
- `/api/x402/pricing/catalog` — free price intelligence discovery

### Paid Endpoints via x402 (no account or key required)
- `/api/x402/pricing/component/{id}` — paid per query over HTTP 402; self-describing requirements

### Private Endpoints (Account API key required)
- All `/api/*` endpoints except public/x402 discovery
- Header: `Authorization: Bearer <api-key>`

## Agent Credential Provisioning

Agents do not register autonomously. A human registers and provisions the
credential on the agent's behalf — the human owns the account; the agent
acts with delegated, revocable access.

1. **Audience:** AI agents acting for a registered human user (account
   holder). There is no anonymous or self-service agent registration.
2. **Provisioning endpoint (human-in-the-loop):** the account holder signs
   in at https://hardwarehunter.io/account and creates or reveals an API
   key (`/account` → API key → Generate/Reveal). The key is shown once;
   store it securely.
3. **Supported credential types:** a single bearer API key per account
   (hex token). Rotating the key at the same endpoint revokes the old one
   immediately.
4. **Credential use:** send `Authorization: Bearer <api-key>` on private
   endpoints. Scopes are account-tier-based (free/pro/lifetime), not
   per-credential. Revocation = rotate or delete the key at `/account`,
   or delete the account.
5. **Agent guidance:** read https://hardwarehunter.io/skill.md first — it
   documents the human-owned-key model and the safe operating patterns.

### Rate Limits
- Effective app limit: 30 requests/minute/IP
- Paid price intelligence (x402): /api/x402/pricing/catalog (free discovery) and trusted data from /api/x402/pricing/component/{id} (~$0.01/query over HTTP 402; insufficient components free)

### Contact
- Support: https://hardwarehunter.io/support
- Email: hello@hardwarehunter.io