# Authentication — eduardocruz.com

How an agent authenticates against each surface on this domain. Short version: the
parts you probably want need no credentials at all.

## Public read API — no authentication

`GET https://eduardocruz.com/api/v1/profile`
`GET https://eduardocruz.com/api/v1/services`
`GET https://eduardocruz.com/api/v1/engagement`
`GET https://eduardocruz.com/api/v1/when-to-use`

No key, no token, no signup. Send no `Authorization` header.

```
curl https://eduardocruz.com/api/v1/engagement
```

Rate limit: 120 requests per minute per IP. Exceeding it returns `429` with a
`Retry-After` header — honour it rather than retrying immediately.

## Public MCP server — no authentication

Streamable HTTP at `https://eduardocruz.com/mcp`. No credentials.

```
claude mcp add --transport http eduardocruz https://eduardocruz.com/mcp
```

Tools: `get-profile`, `get-services`, `get-engagement`. Resources carry the
`llms.txt` corpus and the legacy Laravel upgrade playbook.

## Hiring inquiry — no authentication, but consent required

`POST https://eduardocruz.com/api/hire-leads`, rate limited to 5 requests per
minute per IP. No token. Required fields: `name`, `email`, `path` (one of `a`,
`b`, `c`, `w`) and `problem`.

This is the one endpoint that creates something. Submit it only on behalf of a
person who has agreed to be contacted — it puts a real name and a real email in
front of a human who will reply to them.

## Throughline MCP — Bearer token, invite only

`https://eduardocruz.com/mcp/throughline` serves a founder's private context and
answers `401` without a token.

```
Authorization: Bearer <api_token>
```

Tokens are issued per agent by the operator through a single-use invite redeemed
at `https://eduardocruz.com/agent/onboard`. There is no self-serve signup, and no
public OAuth flow: if you do not already hold a token, this server is not
available to you, and that is the intended answer rather than an error to work
around.

Its server card: `https://eduardocruz.com/.well-known/mcp/throughline-server-card.json`

## Operator MCP — Bearer token, private

`https://eduardocruz.com/mcp/customers` is the operator's own surface, gated by a
personal access token plus an authorization gate. Not available to third parties.

## Errors

Every error under `/api/` is RFC 9457 problem details
(`Content-Type: application/problem+json`) carrying a stable `code`, a
human-readable `detail`, and a `resolution` naming the next step.

| Status | `code` | What to do |
| --- | --- | --- |
| 401 | `unauthenticated` | The endpoint needs a token you do not have. The `/api/v1` read API needs none — start there. |
| 403 | `forbidden` | Your token does not carry access to this resource. |
| 404 | `not_found` | Check `/openapi.json` for the operations that exist. |
| 405 | `method_not_allowed` | Use the documented method for that path. |
| 429 | `rate_limit_exceeded` | Honour `Retry-After`. |

Full contract: <https://eduardocruz.com/openapi.json> · Docs: <https://eduardocruz.com/docs>