# IXORTA Agent and API Authentication

## Current authentication model

IXORTA's published website APIs are public and do not require OAuth, OpenID Connect, API keys, bearer tokens, or agent registration.

Public endpoints:

- `GET /api/health`
- `POST /api/quote`
- `GET /api/mcp`
- `POST /api/mcp`
- `GET /.well-known/api-catalog`
- `GET /.well-known/agent-skills/index.json`

## Agent registration

Agent registration is not currently required or supported.

## Protected APIs

IXORTA does not currently expose protected account, customer, payment, order, or private data APIs. Therefore, no OAuth authorization server or OpenID Provider is advertised. Publishing fake authorization or token endpoints would be unsafe and misleading.

## Safe behavior

The quotation MCP/WebMCP tools prepare links only. They do not send messages, submit forms, make purchases, or create binding orders without visible user action.

Contact: info@ixorta.com