# auth.md

Para Labs does not require authentication.

## Authentication

Public read access needs no account, no API key, and no access token. Send GET. Do not send an Authorization header. There is no login wall and no registration step for agents or for people.

## Protected resource metadata

The read API publishes OAuth Protected Resource Metadata at https://paralabs.ai/.well-known/oauth-protected-resource so an agent can see what the resource is. `resource` is https://paralabs.ai/api/v1. `authorization_servers` is an empty array because this site has no authorization server. `scopes_supported` is empty because nothing is scoped: the record is public.

There is no agent_auth registration method, no identity assertion, and no token endpoint.

## Where to read

- Read API guide: https://paralabs.ai/developers
- OpenAPI: https://paralabs.ai/openapi.json
- API catalog: https://paralabs.ai/.well-known/api-catalog
- Brand record: https://paralabs.ai/api/v1/brands
- Lab studies: https://paralabs.ai/api/v1/research
- MCP server card: https://paralabs.ai/.well-known/mcp/server-card.json

A path that is not one of those endpoints returns an RFC 9457 problem document (`application/problem+json`), not a challenge for credentials.

## Editorial contact

Corrections go to [research@paralabs.ai](mailto:research@paralabs.ai). That mailbox is not an authentication server.