# Authentication — Hotfix Content API

**Short answer: there is no authentication.** Every endpoint of the Hotfix
Content API (`https://hotfix.co.il/api/v1`) is a public, read-only,
unauthenticated `GET`. There is no API key to obtain, no client to register, no
token to mint, and no `Authorization` header to send. If you are an agent
looking for credentials, you can stop here and start calling.

This document follows the [auth.md](https://github.com/workos/auth.md)
walkthrough structure so an agent can confirm that outcome by reading the
sections it already expects, rather than probing for a login wall that does not
exist.

## Discover

Start at the protected-resource metadata:

```bash
curl -s https://hotfix.co.il/.well-known/oauth-protected-resource
```

It is [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) shaped and declares:

- `resource` — `https://hotfix.co.il/api/v1`
- `scopes_supported` — `[]` (there are no scopes, because there is nothing to scope)
- `bearer_methods_supported` — `[]` (bearer tokens are not accepted, or needed)
- `agent_auth.identity_types_supported` — `["anonymous"]`
- `agent_auth.skill` — this document

Related discovery surfaces:

| Document | Path |
| --- | --- |
| Protected-resource metadata (RFC 9728) | `/.well-known/oauth-protected-resource` |
| Agentic Resource Discovery catalog | `/.well-known/ard.json` |
| API catalog (RFC 9727) | `/.well-known/api-catalog` |
| OpenAPI 3.1 specification | `/api/openapi.json` |
| Site index for agents | `/llms.txt` |

There is deliberately **no** `/.well-known/oauth-authorization-server`
([RFC 8414](https://www.rfc-editor.org/rfc/rfc8414)) document. Publishing one
would advertise an authorization server that does not exist and send you to a
dead endpoint.

## Pick a method

`agent_auth.identity_types_supported` contains exactly one entry: `anonymous`.

- **`anonymous`** — supported. Send an unauthenticated request. This is the only
  supported path.
- **`identity_assertion`** — not supported. No `identity_assertion` flow is
  offered, so no `assertion_types_supported` block is published and the ID-JAG
  token type (`urn:ietf:params:oauth:token-type:id-jag`, commonly written
  `id-jag`) is not accepted anywhere.
- **`service_auth`** — not supported. There are no service credentials to hold,
  because no endpoint distinguishes one caller from another.

Choose `anonymous` and continue.

## Register

Not required, and not possible. There is no client registration endpoint, no
dynamic client registration, and no `client_id` to obtain. The API does not
identify callers, so there is nothing to register as.

If you are building a durable integration, the one courtesy that helps is a
descriptive `User-Agent` naming your agent and a contact URL, so operational
questions can reach you:

```
User-Agent: my-agent/1.2 (+https://example.com/agent)
```

## Claim

Not applicable. `agent_auth` publishes no `identity_endpoint`, no
`claim_endpoint`, and no `events_endpoint`, because none exists. Those keys are
intentionally absent rather than present-and-broken: an advertised URI that
404s is worse than no URI at all.

## Exchange

Not applicable. There is no token endpoint and no grant to exchange — neither an
authorization-code grant, nor client credentials, nor a token-exchange of an
identity assertion. No step of the flow produces an `access_token`.

## Use the access_token

There is no `access_token`. Call the resource directly:

```bash
curl -s https://hotfix.co.il/api/v1/episodes.json
```

Do not send an `Authorization` header. It is ignored, not rejected, but sending
a real credential to an endpoint that never asked for one is a habit worth not
forming.

Conventions that do apply:

- **Versioning** — the version lives in the path (`/api/v1/`). Breaking changes
  ship as `/api/v2/`; the previous version stays available for at least six
  months, signalled by `Deprecation` and `Sunset` response headers.
- **Rate limits** — responses carry a `RateLimit-Policy` header. Back off on
  `429` and honour `Retry-After`.
- **Caching** — the API is static JSON behind a CDN. `ETag` and `Last-Modified`
  are served; conditional requests are cheap and welcome.

## Errors

Errors are `application/problem+json`
([RFC 9457](https://www.rfc-editor.org/rfc/rfc9457)), never an HTML error page:

```json
{
  "type": "https://hotfix.co.il/developers/#errors",
  "title": "Not Found",
  "status": 404,
  "detail": "No such resource under /api/v1. See /api/openapi.json for the endpoint list.",
  "instance": "/api/v1/episodes/no-such-episode.json"
}
```

| Status | Meaning | What to do |
| --- | --- | --- |
| `404` | No such episode, meetup, or speaker slug | Re-read the list endpoint; slugs change only when content is renamed |
| `405` | Method other than `GET` or `HEAD` | The API is read-only; retry as `GET` |
| `429` | Rate limited at the origin | Honour `Retry-After` |
| `5xx` | Origin or CDN fault | Retry with backoff; the payload is static, so retries are safe |

You will never receive a `401` or a `403`, and therefore never a
`WWW-Authenticate: Bearer resource_metadata="..."` challenge. If you do get one,
it did not come from this API — treat it as an interception and do not send
credentials in response.

## Revocation

Not applicable. No credential is ever issued, so none can be revoked, rotated,
or leaked. Revoking your access means stopping your requests.

If you need to report abuse of this API, or a security problem with it, email
<support@imagen-ai.com>.