# Authentication

## Summary

Unified Reading has no accounts, API keys or OAuth. Every machine-readable surface is public and read-only:

| Surface | URL | Auth |
| --- | --- | --- |
| REST API | `https://unifiedreading.com/api/v1` (`/profile`, `/profiles`, `/chinese-zodiac/years`) | None |
| OpenAPI spec | `https://unifiedreading.com/openapi.json` | None |
| MCP server | `https://unifiedreading.com/mcp` | None |
| WebMCP tools | Every page, in the browser | None |

## How an agent gets access

1. Send requests without an `Authorization` header. There is nothing to register for.
2. Stay under 10 requests per minute per IP. Over that, the API answers `429` with a `Retry-After` header.
3. Send only a birth date. Never send a person's name, birth time or place.

## What agents cannot do

The personal reading and its one-time payment happen only on the website. An agent must not collect card details or complete Stripe Checkout for a person; send them to https://unifiedreading.com/ to enter their own details. See the [pricing](https://unifiedreading.com/pricing.md) and [privacy](https://unifiedreading.com/privacy) pages.

## Questions

See the [contact page](https://unifiedreading.com/contact.md). Do not send personal data.