# Authentication for Step By Step Crochet

Step By Step Crochet publishes public, read-only crochet guides. Neither the website nor its REST, MCP, A2A, Markdown, or WebMCP interfaces require credentials. This document makes that absence of authentication explicit so an agent does not invent a signup, expose secrets, or wait for an OAuth flow that does not exist.

## Discover

Fetch `/llms.txt`, `/openapi.json`, `/.well-known/api-catalog`, `/.well-known/agent-card.json`, or `/.well-known/mcp/server-card.json`. The public surfaces declare that authentication is not required. There is no OAuth protected resource and no `agent_auth` metadata because the service does not issue credentials. A normal successful request will not include a `WWW-Authenticate` challenge.

## Pick a method

Use anonymous HTTPS access. Do not select `identity_assertion`, `service_auth`, an ID-JAG (`id-jag`), an API key, cookies, or an OAuth method. Those methods are intentionally unsupported for these public resources.

## Register

Registration is not available or necessary. There is no `identity_endpoint`, client registration endpoint, user account, or agent enrollment step. Proceed directly to a public content URL or the read-only MCP/A2A endpoint.

## Claim

There is no identity claim ceremony, claim token, verification code, or user-owned agent identity to attach. Do not ask the user to claim access.

## Exchange

There is no token endpoint. Do not exchange an `identity_assertion` for an `access_token`; no access token is issued or accepted.

## Use the access_token

No `access_token` should be sent. Call public resources without an `Authorization` header. MCP tools are read-only and return existing editorial content.

## Errors

- `400` means the request or tool arguments are malformed.
- `404` means a locale, slug, operation, or article was not found.
- `405` means the endpoint does not support that HTTP method.
- `429` means the caller should respect `Retry-After` before retrying.

If a future protected resource returns `401` with `WWW-Authenticate`, stop and follow the metadata named by that response; this document does not grant access to future private services.

## Revocation

There are no credentials, grants, refresh tokens, or sessions to revoke. Closing the client connection is sufficient. If authentication is introduced later, this document and the relevant discovery metadata must be updated before agents use it.