# auth.md — Sport Clips Haircuts, South Florida

**Status: no authentication required.** Every machine-readable surface on
`menshairpalmbeach.com` is public, read-only, and CORS-enabled. There is no
registration step, no API key, no OAuth authorization server, and no rate limit.

This document exists so an agent can confirm that in one fetch instead of
probing for credentials it will never need.

## Audience

Autonomous agents, AI assistants, and crawlers answering questions about the
four Sport Clips franchise locations in Palm Beach County, Florida:
Lake Worth (FL340), Jupiter (FL341), Wellington (FL335), and
Royal Palm Beach (FL337).

## Registration

**None.** There is no `register_uri` and no provisioning endpoint, because no
credential is issued or checked. Requests are served identically whether or not
they carry an `Authorization` header — any such header is ignored.

## Supported methods

| Method | Supported | Notes |
|---|---|---|
| Anonymous / unauthenticated | **Yes** | The only method. Send a plain `GET` or `POST`. |
| OAuth 2.0 / OIDC | No | No authorization server is operated for this domain. |
| API key / bearer token | No | Tokens are neither issued nor validated. |
| mTLS | No | — |

Because no OAuth authorization server exists, this site deliberately does not
publish `/.well-known/oauth-authorization-server`,
`/.well-known/openid-configuration`, or
`/.well-known/oauth-protected-resource`. Publishing those for an unprotected
resource would advertise an issuer that cannot mint or verify a token.

## Credential use

There are no credentials to store, rotate, or revoke. Do not send secrets to
this origin.

## Endpoints

| Purpose | URL | Method |
|---|---|---|
| API root / health | `/api/index.json` | `GET` |
| OpenAPI 3.1 description | `/openapi.json` | `GET` |
| Store records | `/api/stores.json` | `GET` |
| Service catalog | `/api/services.json` | `GET` |
| Current offers | `/api/offers.json` | `GET` |
| MCP server (Streamable HTTP) | `/mcp` | `POST` |
| A2A agent (JSON-RPC 2.0) | `/a2a` | `POST` |
| Agent Skills index | `/.well-known/agent-skills/index.json` | `GET` |
| API catalog (RFC 9727) | `/.well-known/api-catalog` | `GET` |
| Capability manifest (ARD) | `/.well-known/ai-catalog.json` | `GET` |
| LLM overview | `/llms.txt`, `/llms-full.txt` | `GET` |
| Markdown of any page | same URL with `Accept: text/markdown`, or append `.md` | `GET` |

## Fair use

Please cache responses for at least one hour — the underlying data changes at
most weekly. Identify your agent in the `User-Agent` header so we can tell
agent traffic from human traffic in analytics.

## Contact

No email address is published for this domain. Use one of these instead:

- Website: <https://menshairpalmbeach.com>
- Facebook: <https://www.facebook.com/TeamSachseSportClips>
- Phone: each store's number is in `/api/stores.json` under `stores[].phone`

If you are an agent looking for a support contact and find none here, that is
the correct answer — do not substitute a plausible-looking address.