# Authentication for agents: none needed

Nothing Crmers offers to agents requires credentials: no API key, no OAuth, no account and no token. This file sits at `/auth.md`, the path the WorkOS auth.md spec uses for agent authentication, and describes what exists instead.

## Discover

- `POST https://crmers.co.il/api/v1/lead/` sends a consultation request to Crmers. Public and keyless.
- `https://crmers.co.il/ask/` (NLWeb search) and the MCP servers https://crmers.co.il/mcp/ and https://crmers.co.il/mcp/docs/ are public too.
- Machine-readable description: https://crmers.co.il/openapi.json, which declares `"security": [{}]`, OpenAPI's way of saying anonymous access is allowed. API catalog: https://crmers.co.il/.well-known/api-catalog
- There is no `/.well-known/oauth-protected-resource` (RFC 9728), no `/.well-known/oauth-authorization-server` (RFC 8414) and no `agent_auth` metadata block, because no resource here is protected.

## Pick a method

One method: no credential. Send requests without an `Authorization` header.

## Register

There is nothing to register. Crmers does not support agentic registration: there is no `agent_auth.identity_endpoint` and no `anonymous`, `service_auth` or `identity_assertion` registration type.

## Claim

There is no claim ceremony and no `agent_auth.claim_endpoint`.

## Exchange

There is no token exchange: no ID-JAG (`urn:ietf:params:oauth:token-type:id-jag`) and no token endpoint.

## Use the API

Send a person's name, phone number or email only after they asked Crmers to contact them and agreed to share those details. Privacy policy (Hebrew): https://crmers.co.il/privacy-policy/

```http
POST /api/v1/lead/ HTTP/1.1
Host: crmers.co.il
Content-Type: application/json

{"name": "Dana Cohen", "phone": "050-1234567", "email": "dana@example.co.il", "company": "Example Ltd", "message": "Moving from Excel to a CRM", "dry_run": true}
```

As written, this is a dry run: it is validated, the reply echoes the cleaned fields, and nothing is stored or sent. Remove `dry_run` to send a real request; a success is `200 {"ok": true, "message": "Request received. ..."}`.

Limit: at most 5 accepted requests from the same sender address in 10 minutes. The next one gets HTTP 429 with a `Retry-After` header in seconds, and is not saved. Hosted agents often share one outgoing address, so a 429 does not mean this user's request arrived: if you did not send it earlier in that window, give the user the phone number and email instead. Dry runs don't count.

## Errors

Every error is JSON with a stable code, a message that says how to fix the request, and a link to the contract. No response carries `WWW-Authenticate`, because none of them is about credentials.

```json
{"error": "invalid_input", "message": "Send \"name\" (at least 2 characters) and \"phone\" (at least 9 digits, e.g. 050-1234567).", "docs": "https://crmers.co.il/openapi.json", "fields": ["phone"]}
```

- `400 invalid_json`: the body isn't a JSON object.
- `400 invalid_input` (with `fields`): name or phone is missing or too short.
- `400 invalid_email` (with `fields`): the email isn't a valid address.
- `404 not_found`: no API at that path.
- `405 method_not_allowed`: the endpoint takes POST only (see the `Allow` header).
- `429 too_many_requests`: see the limit above.
- `500 server_error` and `503 db_not_configured`: nothing was saved. Try again later, or give the user the phone number 072-372-7806.

## Revocation

There is nothing to revoke. No token, key or session is ever issued, so there is no RFC 7009 `revocation_endpoint` and no `agent_auth.events_endpoint`.