# RuShiWoWen authentication The public scripture pages, JSON API, Markdown API, and MCP tools are read-only and do not require an API key, account, OAuth token, or other credential. There are no OAuth 2.0 scopes for these public resources. ## Discover The public interfaces are intentionally open. An agent can discover them from [the OpenAPI document](https://rushiwowen.co/openapi.json), the [MCP server card](https://rushiwowen.co/.well-known/mcp/server-card.json), and [developer resources](https://rushiwowen.co/developers). This service does not currently publish `oauth-protected-resource` (RFC 9728) or `oauth-authorization-server` (RFC 8414) metadata because no public endpoint requires OAuth. ## Pick a method Use unauthenticated HTTPS requests for the read-only resources below. Do not invent an API key or bearer token when calling them. - [OpenAPI specification](https://rushiwowen.co/openapi.json) - [MCP server](https://rushiwowen.co/mcp) - [Markdown API](https://rushiwowen.co/api/md?_u=/r/heart-sutra) ## Register Registration is not required for the public interfaces. There is no `register_uri`, `agent_auth`, or client-registration endpoint at this time. ## Claim No identity assertion or ID-JAG claim is needed for public read-only access. If a future private endpoint introduces claims, its documentation will state the required issuer, audience, and scopes before the endpoint returns `401`. ## Use the credential There is no credential to send. A client may send `Accept: text/markdown` for Markdown responses, or use the JSON operations documented in OpenAPI. ## Errors Public endpoints return ordinary HTTP status codes and structured JSON errors where applicable. A `401` response from a future protected endpoint will include a `WWW-Authenticate` challenge and link to updated metadata. ## Revocation Because public calls have no credential, there is nothing to revoke. Future credentials will document expiration, revocation, and support contact details.