# auth.md

Cantabebe does not run an OAuth or OpenID Connect authorization server. Public agent actions do not require registration, API keys, or bearer tokens.

## Audience

AI agents helping a parent or caregiver request the free personalized family song.

## Public methods

| Action | Method | Auth |
| --- | --- | --- |
| Request the free family song | `POST https://api.cantabebe.com/submit-form` | None |
| Subscribe to the blog | `POST https://api.cantabebe.com/subscribe` | None |
| MCP tool `request_family_song` | `POST https://api.cantabebe.com/mcp` | None |

There is no `register_uri`, client credentials grant, or agent enrollment endpoint. Do not send `Authorization` headers to these URLs.

## Credential use

Submit JSON with the parent's email, the baby's given name, and gender. Cantabebe emails the song to that address after manual approval. The email is the delivery channel, not an OAuth identity.

## Out of scope

Admin approve/reject links, PayPal checkout, webhooks, and song download URLs are for Cantabebe staff, PayPal, or the parent who received the email. They are not agent registration APIs. Those flows use signed tokens or PayPal, not OAuth discovery metadata.

## Discovery

- API catalog: `https://cantabebe.com/.well-known/api-catalog`
- OpenAPI: `https://cantabebe.com/openapi.json`
- Docs: `https://cantabebe.com/docs/api.md`