# NeuraPay auth.md

## Audience and public access

This document is for agents reading public NeuraPay product information, pricing and aggregate demo availability. The public advisor requires no API key, OAuth login or agent registration. Its five tools are read-only.

Supported access method: public requests without credentials. Registration or provisioning endpoint: none. This is not an implementation of the auth.md agent-registration protocol; no agent account, access token, claim ceremony or delegated user access is offered.

## Connect without credentials

Use [the MCP endpoint](https://www.neurapay.ai/mcp) with Streamable HTTP, or POST a validated tool request to [the HTTP endpoint](https://www.neurapay.ai/api/advisor). Discover the exact tools and argument schemas through [the AI catalog](https://www.neurapay.ai/.well-known/ai-catalog.json) or [OpenAPI](https://www.neurapay.ai/openapi.json). Do not attach an Authorization header or request credentials from the visitor.

## Private data and confirmation

No customer, debtor, invoice or payment data is exposed. This domain does not advertise an OAuth issuer or protected customer API. Portal authentication is a separate system and must not be inferred from this public interface.

Handoff links are not transactions: the visitor reviews and explicitly confirms on the website; demo booking requires email verification. Do not send credentials, personal records or verification codes to the public advisor.

## Limits and errors

Public requests are rate limited. Respect 429 and Retry-After. A 403 origin/host rejection must not be bypassed. Correct invalid arguments after a 400 response; do not treat a 503 response as a successful action or invent a result. Respect input-size and verification controls.