# THORChain auth.md

## Public access

The public resources on `thorchain.org` do not require agent registration, authentication, or credentials.

This includes:

- `https://thorchain.org/llms.txt`
- `https://thorchain.org/llms-full.txt`
- `https://thorchain.org/AGENTS.md`
- `https://thorchain.org/openapi.json`
- `https://thorchain.org/.well-known/mcp/server-card.json`
- `https://thorchain.org/mcp`

## Supported method

Use anonymous HTTPS requests. Do not send API keys, bearer tokens, wallet secrets, seed phrases, or signed transaction material.

## Agent registration

No agent registration or provisioning endpoint is offered by this website. There is no OAuth/OIDC issuer for `thorchain.org`, so the site intentionally does not publish:

- `https://thorchain.org/.well-known/openid-configuration`
- `https://thorchain.org/.well-known/oauth-authorization-server`
- `https://thorchain.org/.well-known/oauth-protected-resource`

Agents must not invent an issuer, client registration flow, token endpoint, JWKS URI, OAuth scopes, or bearer-token flow for this site. The public resources above are available directly over HTTPS without credentials.

The separate swap aggregator at `https://api.thorchain.org/v1` may require an `x-api-key`. That is not a credential issued by `thorchain.org` and is not an OAuth/OIDC flow. Follow the [THORChain Swap authentication documentation](https://swap.thorchain.org/developers/auth) and register through the [affiliate dashboard](https://affiliate.thorchain.org/); do not send that key to this website or to the public MCP endpoint.

If a future THORChain API introduces OAuth-protected resources, its own origin must publish valid OAuth authorization-server and protected-resource metadata with real issuer, token, JWKS, registration, scope, and revocation URLs.

## Scope

Public access is limited to website discovery, documentation lookup, and the read-only MCP tools described in the MCP server card. It does not grant permission to trade, sign transactions, move funds, manage accounts, or access private systems.

Live protocol and market-data APIs may have separate availability, rate limits, and policies. Follow the current official developer documentation for those services.