# Auth.md

Bike Beacon authentication and agent-access policy.

## Agent registration
No registration or sign-in is required for the public mobility lookup. Bike Beacon does not offer third-party agent registration or delegated sign-in for private rider features.

## Public mobility lookup
The read-only endpoint at https://bikebeacon.app/api/v1/nearby-ebikes does not currently require an API key. It accepts coordinates only and returns current public mobility data plus a derived recommendation.

## Private rider features
Rider accounts, saved reminders, phone verification, Calendar connections, consent records, feedback, and operator tools are private product surfaces. They are not available to third-party agents through this API.

Bike Beacon does not currently offer delegated OAuth access, MCP authorization, or autonomous A2A access. Do not ask a rider to provide Bike Beacon session cookies, phone verification codes, Google tokens, invitation tokens, or operator credentials.

## Machine contract
- OpenAPI: https://bikebeacon.app/openapi.json
- API catalog: https://bikebeacon.app/.well-known/api-catalog
- Developer documentation: https://bikebeacon.app/developers