# auth.md

> Agent access policy for https://neurohackingly.com — a personal blog
> about neurohacking, focus and applied AI (posts in English). Last updated:
> 2026-08-05.

## TL;DR for agents

No registration. No sign-up. No credentials. Everything on this site is
public and readable anonymously. There is nothing to register for — do not
start an OAuth flow; no authorization server exists.

## Audience

Any AI agent, assistant, or crawler acting autonomously or on behalf of a
user. AI crawlers (GPTBot, ClaudeBot, PerplexityBot, and others) are
explicitly welcome — see `/robots.txt` (including its Content-Signal
declarations).

## Identity and registration

- Supported identity type: **anonymous** (unauthenticated access) only.
- Agent registration: **not required and not available.** This site has no
  user accounts, no login, and no protected resources.
- Credential types issued: **none.** No API keys, no access tokens, no
  sessions, no cookies required.
- OAuth Protected Resource Metadata (RFC 9728):
  `/.well-known/oauth-protected-resource` confirms this machine-readably —
  `authorization_servers` is an **empty array**, meaning no tokens exist and
  none are needed.
- OAuth/OIDC discovery: this site intentionally publishes **no**
  `/.well-known/openid-configuration` and **no**
  `/.well-known/oauth-authorization-server` metadata, because there is no
  authorization server. A 404 at those paths is correct and expected.

Machine-readable summary:

```json
{
  "resource": "https://www.neurohackingly.com",
  "registration_required": false,
  "identity_types_supported": ["anonymous"],
  "credential_types_supported": [],
  "authorization_servers": []
}
```

## How to read content (no auth)

Plain, unauthenticated `GET` requests:

- `/llms.txt` — index of all posts with agent-friendly links
- `/llms-full.txt` — full text of every published post in one Markdown file
- `/{slug}.md` — clean Markdown mirror of any blog post (`/index.md` for the
  homepage); any post URL also answers `Accept: text/markdown`
- `/rss.xml` — RSS feed
- `/sitemap-index.xml` — sitemap
- `/.well-known/api-catalog` — API catalog (RFC 9727)
- `https://www.neurohackingly.com/mcp` — read-only MCP server (Streamable
  HTTP, no auth); see `/.well-known/mcp/server-card.json`

## The only write endpoint: `POST /api/subscribe`

Newsletter signup (double opt-in). Open endpoint — no auth header, no API
key, no token.

- Method: `POST`
- Body: `application/x-www-form-urlencoded` or `multipart/form-data`
- Fields:
  - `email` (required) — subscriber email address
  - `name` (optional) — first name
  - `source` (optional) — free-form label for where the signup came from
- Response: with `Accept: application/json` you get `200` and
  `{"status":"success"}`, `{"status":"already"}` or `{"status":"error"}`;
  without it, a `303` redirect back to the page.

Agents MUST only submit this endpoint with the explicit consent of the
person whose email address is used — a double-opt-in confirmation email is
sent to that address.

## Rate limits and abuse

Static content is CDN-served; read traffic is uncritical. `/api/subscribe`
runs as a serverless function — do not poll it and do not retry
aggressively (rate limit: 5 requests per minute per IP).

## Contact

Questions about agent access: zangerl.luk@gmail.com