# auth.md — agent access to lumavik.org

## Audience

AI agents and automated clients reading the public data this site publishes, and agents acting for a
person who uses the Lumavik aurora forecast app.

## Reading the data: no authentication

Every endpoint under `https://lumavik.org/api/v1/` is public, keyless and CORS-open. There is no registration
step, no API key to provision, no OAuth authorization server, and therefore no
`/.well-known/oauth-authorization-server` document to fetch — publishing one would advertise a flow
that does not exist.

| Endpoint | What it returns |
|---|---|
| `https://lumavik.org/api/v1/visibility.json` | Oval-edge model by Kp, NOAA storm scale, viewing bands |
| `https://lumavik.org/api/v1/cities.json` | 14 locations with both Kp thresholds and solstice darkness |
| `https://lumavik.org/api/v1/darkness.json` | Astronomical darkness by latitude and month, season windows, camera model |
| `https://lumavik.org/api/v1/glossary.json` | 41 terms, one self-contained sentence each |
| `https://lumavik.org/api/v1/sources.json` | 41 primary sources, plus the live keyless NOAA feeds |
| `https://lumavik.org/api/v1/status.json` | Freshness of the datasets |
| `https://lumavik.org/api/v1/openapi.json` | OpenAPI 3.1 description of all of the above |

**None of it is live.** It publishes what a location needs, not what the Sun is doing. Current
conditions come from NOAA SWPC, which is free, keyless and CORS-open; `sources.json` names the four
endpoints this site itself reads, so there is no reason to scrape a page that re-renders them.

Fair use: these are static files behind a CDN. Cache them. They change when the site is rebuilt.

Licence: CC BY 4.0. Attribute to Lumavik — https://lumavik.org, or to the page a figure came from.

## Agent registration

**No registration is required, and none is possible.** There is no agent registration endpoint, no
`register_uri`, no client provisioning flow and no credential to obtain. The supported identity
type is **anonymous**: an agent may identify itself with a User-Agent string, and nothing about the
response changes either way.

| Question | Answer |
|---|---|
| Registration endpoint | None. Read the endpoints directly. |
| Supported auth methods | `none` (anonymous) |
| Credential types | None issued |
| Token endpoint | None |
| Scopes | None — every endpoint is public and read-only |
| Rate limit tied to identity | None |

The same, machine-readable. This is the honest shape of an `agent_auth` block for a service that
authenticates nobody — the registration, credential and revocation URIs are `null` because they do
not exist, not omitted, so a client can tell "declared absent" from "forgot to publish".

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": [],
      "claim_uri": null
    },
    "register_uri": null,
    "revocation_uri": null,
    "events_supported": [],
    "documentation": "https://lumavik.org/api/"
  }
}
```

## Tools: MCP and A2A

An MCP server is published at `https://lumavik.org/mcp` (Streamable HTTP, no authentication); its card is at
`https://lumavik.org/.well-known/mcp/server-card.json`. An A2A endpoint answering the same questions in prose is
at `https://lumavik.org/a2a`, card at `https://lumavik.org/.well-known/agent-card.json`. Both expose the read-only data
above as tools. Neither holds a live reading, sends an alert, or knows anything about a user.

## Acting for a user: not available to agents

The Lumavik app sends aurora alerts to a device. Subscribing, setting a threshold and receiving a
push notification all happen inside the app on the user's own device, and the subscription is
authenticated by the device's App Store account. There is no server-side user API, no agent
registration endpoint, and no credential an agent could hold that would let it subscribe, alert or
pay on someone's behalf. If you are an agent asked to "alert me when the aurora is out", the correct
answer is to hand the user the app, or to poll the NOAA feed yourself — not to attempt an
integration that does not exist.

## Contact

Support and abuse: support@lumavik.org · https://lumavik.org/contact/