# KodExport auth.md

## Audience and service

This document is for agents and developers using KodExport's public tools API at
https://api.kodexport.com. The website at https://kodexport.com has no login.

## Registration and supported methods

The public tools require no registration, account provisioning, API key, or OAuth
grant. The supported access method is unauthenticated HTTPS. There is no agent
registration or provisioning endpoint for these operations; do not POST to
`/agent/auth` or attempt to create an account.

- `GET https://api.kodexport.com/scan?url=…` — scan a supported public page.
- `GET https://api.kodexport.com/fetch?url=…` — fetch public source text.
- `GET https://api.kodexport.com/export?url=…` — export one supported page as a ZIP.
- `GET https://api.kodexport.com/health` — check whether the API responds.

URL-encode the `url` query parameter. Sources must be publicly accessible HTTP(S)
URLs without embedded credentials. IP-based quotas apply; a `429` response
includes `Retry-After`. Access is unauthenticated, not unlimited.

## Credential use

Do not send an `Authorization` header, API keys, passwords, or private source
credentials to the public operations above. No credentials are issued or stored
for this access method, so there is no credential claim or revocation endpoint.

The public tools do not use an OAuth authorization server or protected resource
metadata. Unauthenticated access here is not an anonymous registration flow and
does not issue bearer tokens.

## Other workflows

This document covers the public tools only. Paid export access uses a separate
purchase flow and is not agent account registration. The hosted migration MCP
has its own OAuth connection flow; follow the [MCP setup guide](https://kodexport.com/mcp/)
when connecting that service. Its credentials do not apply to these public tools.

### Hosted MCP discovery

The protected resource is `https://mcp.kodexport.com/mcp`. Its published OAuth
discovery documents are:

- [Protected Resource Metadata](https://mcp.kodexport.com/.well-known/oauth-protected-resource/mcp)
- [Authorization Server Metadata](https://mcp.kodexport.com/.well-known/oauth-authorization-server)

The [MCP server card](https://kodexport.com/.well-known/mcp/server-card.json)
provides the hosted endpoint and server identity in the legacy discovery format.
Connect through OAuth and negotiate capabilities at runtime before using tools,
resources, or prompts; the card does not grant access.

The authorization server issuer is `https://mcp.kodexport.com`. The protected
resource supports the `migration` scope and bearer tokens in the `Authorization`
header. Obtain credentials through the MCP client's OAuth connection flow and
send them only to the protected MCP service.

The metadata URL includes `/mcp` because RFC 9728 discovery is derived from the
resource identifier. The marketing website and free public tools are not OAuth
protected resources and do not publish their own Protected Resource Metadata.

## API discovery

- [API reference](https://kodexport.com/api/)
- [OpenAPI specification](https://kodexport.com/openapi.json)
- [API catalog](https://kodexport.com/.well-known/api-catalog)