# Shipwork auth.md

How an AI agent authenticates with Shipwork.

## Short version

No credentials are needed to use Shipwork's checks. Every endpoint in the [OpenAPI document](https://shipwork.io/openapi.json) accepts anonymous requests. There is no agent registration and no API key.

## Limits instead of keys

- Anonymous: 5 checks a week per visitor (IP and device), resetting on Monday.
- Signed-in account: 25 a week. A paid plan removes the weekly cap.
- A request over the limit gets HTTP 429 with `"code": "free_limit"`.

## Accounts

Accounts belong to people, not agents. A person signs in with Google at https://shipwork.io/account; the session is an HttpOnly cookie. Shipwork does not issue tokens to agents, and does not run an OAuth authorization server, so there is no OAuth metadata to discover.

## Agent-facing documents

- API catalog: https://shipwork.io/.well-known/api-catalog
- OpenAPI: https://shipwork.io/openapi.json
- Human docs: https://shipwork.io/api-docs
- MCP server (Streamable HTTP): signed-in accounts only. Each account creates a personal address at https://shipwork.io/account (it looks like https://shipwork.io/mcp/swm_...); tools run as that account, with its allowance. Card: https://shipwork.io/.well-known/mcp/server-card.json
- Agent skill: https://shipwork.io/.well-known/agent-skills/index.json
- Site summary: https://shipwork.io/llms.txt