# auth.md

How AI agents authenticate with Flamel.

Last updated: 2026-08-10

## TL;DR

The public agent resources listed below are **public and require no authentication**.
Read them freely with an ordinary HTTP client, an MCP client, or an A2A client.

The Flamel **product** API (the one that reads and writes a customer's
workspaces, posts, ads, and analytics) is a separate, authenticated resource on
a different host. It is not self-serve today: access is granted per customer.
Contact <hello@flamel.ai> to request it.

## Agent audience

| Audience | What it can do | Auth |
| --- | --- | --- |
| Any agent, no account | Read Flamel's published marketing content: company overview, blog posts, case studies, FAQ entries, testimonials | None |
| Agent acting for a Flamel customer | Read and write that customer's workspaces, content, campaigns, and analytics | Separately provisioned product access; Flamel supplies the current authorization details during onboarding |

## Public surfaces (no credentials)

| Surface | Endpoint | Notes |
| --- | --- | --- |
| MCP server | `https://www.flamel.ai/mcp` | Streamable HTTP, stateless. Card: [`/.well-known/mcp/server-card.json`](https://www.flamel.ai/.well-known/mcp/server-card.json) |
| A2A agent | `https://www.flamel.ai/a2a` | A2A 1.0 JSON-RPC `SendMessage`. Card: [`/.well-known/agent-card.json`](https://www.flamel.ai/.well-known/agent-card.json) |
| Content GraphQL API | `https://www.flamel.ai/api/graphql` | Anonymous access is restricted to published reads. Authenticated CMS operations are separate and are not part of this public agent contract. Catalog: [`/.well-known/api-catalog`](https://www.flamel.ai/.well-known/api-catalog) |
| OpenAPI | [`/openapi.json`](https://www.flamel.ai/openapi.json) | Typed public operations; every operation declares `security: []` |
| Markdown | every public marketing page, via `Accept: text/markdown` or a `.md` suffix | e.g. `https://www.flamel.ai/solutions.md`. Root is `/index.md` |
| Agent skills | [`/.well-known/agent-skills/index.json`](https://www.flamel.ai/.well-known/agent-skills/index.json) | |
| Site summary | [`/llms.txt`](https://www.flamel.ai/llms.txt) | |

Send no `Authorization` header when using this public contract. No credential
is required, and anonymous calls through these documented operations cannot
mutate anything.

### Rate and crawl expectations

- The public API limit is 60 requests per minute per client. Responses include
  `RateLimit` and compatibility `RateLimit-*` fields; a 429 also includes
  `Retry-After`.
- Identify yourself with a descriptive `User-Agent`. Web Bot Auth
  (`Signature` / `Signature-Agent`) request headers are accepted and are the
  preferred way to identify an automated client.
- Honour [`/robots.txt`](https://www.flamel.ai/robots.txt), including its Content Signals:
  `search=yes, ai-train=no, ai-input=yes`. Reading our content to answer a
  user's question right now is welcome. Retaining it as model training data is
  not.

## Authenticated product API

There is **no dynamic client registration and no self-serve agent registration
endpoint on this domain**. Do not attempt to POST to `/agent/auth`,
`/register`, or any similar path here: nothing is listening.

### Agent registration and provisioning

| Field | Value |
| --- | --- |
| Registration method | Manual, customer-scoped provisioning |
| Registration contact | <hello@flamel.ai> or the customer's Flamel customer-success contact |
| Authorization details | Supplied during provisioning; there is no public issuer metadata on this website today |
| Credential type | Customer-scoped credentials, when product API access is approved |

To register an agent for product API access:

1. Email <hello@flamel.ai> from the address on the Flamel account, or ask your
   Flamel customer success contact. Say which workspaces the agent needs and
   whether it needs write access.
2. Flamel confirms whether product API access is available for that account and
   supplies the current authorization server, resource identifier, scopes, and
   credential lifecycle out of band.
3. Follow those issued details. Do not infer endpoints from this public website.

When the product authorization server becomes publicly discoverable, this
document will point at its
`/.well-known/oauth-authorization-server` and
`/.well-known/oauth-protected-resource` metadata, and those documents become
authoritative over the prose above.

## Contact

- Access requests and agent partnerships: <hello@flamel.ai>
- Security reports: <tech@flamel.ai>, or see [`/.well-known/security.txt`](https://www.flamel.ai/.well-known/security.txt)
- Flamel, 727 Madison Ave, Office 240, Covington, KY 41011