# Atlas Oracle Authentication Guide

This guide describes how agents and developer tools should treat Atlas Oracle public and authenticated surfaces.

## Public access

The following resources are public and do not require authentication:

- https://atlasoracle.io/
- https://atlasoracle.io/pricing
- https://atlasoracle.io/feeds
- Public feed detail pages at `https://atlasoracle.io/feeds/{feedId}` when the feed is public
- https://docs.atlasoracle.io/
- Developer documentation under `https://docs.atlasoracle.io/developers/`
- https://atlasoracle.io/llms.txt
- https://atlasoracle.io/api-catalog.md
- https://atlasoracle.io/sitemap.xml
- https://atlasoracle.io/robots.txt

## Authenticated surfaces

The following surfaces are user-specific and require an authenticated user session in the application:

- Account and user center pages
- Feed creation flows
- Feed editing flows
- Billing review and payment status flows
- Private feed data and private account configuration
- API credentials and contract access management

Agents must not attempt to perform account, billing, payment, or feed-management actions unless the user has explicitly authorized that action in an authenticated Atlas Oracle session.

## OAuth and token discovery

This repository does not publish OAuth authorization server metadata, OAuth protected resource metadata, MCP server cards, A2A agent cards, or WebMCP endpoints. Treat those protocols as unavailable unless Atlas Oracle publishes a future discovery document that says otherwise.

## Recommended agent behavior

1. Read `https://atlasoracle.io/llms.txt` for high-level site guidance.
2. Use `https://atlasoracle.io/api-catalog.md` to locate public documentation and protocol status.
3. Use public docs pages for integration instructions.
4. Respect `robots.txt`, canonical links, and page-level `noindex` directives.
5. Ask the user to complete any required login or account action themselves unless an official authenticated API flow is documented.