# Authentication · StartBrain public API (startbrain.io)

**Short version: there is nothing to authenticate.** Every machine entry point of startbrain.io (the `/api/v1/` API, the NLWeb `/ask` search, the feeds, the markdown twins) is public, anonymous and read-only. No API key, no OAuth, no account, no token. This page follows the usual `auth.md` outline so that an agent looking for the authentication procedure finds an explicit answer at every step instead of a missing page.

## 1. Discover

- API index: `GET https://startbrain.io/api/v1/` (JSON, links to every endpoint and policy)
- OpenAPI 3.1: https://startbrain.io/api/v1/openapi.json (also at https://startbrain.io/openapi.json)
- API catalog (RFC 9727): https://startbrain.io/.well-known/api-catalog
- Human and agent documentation: https://startbrain.io/developers/

There is no OAuth authorization server metadata (`/.well-known/oauth-authorization-server`) and no protected resource metadata (`/.well-known/oauth-protected-resource`) on this domain, because no resource is protected.

## 2. Pick a method

| Method | Available | Notes |
|---|---|---|
| Anonymous | yes | The only method. Send plain requests. |
| API key | no | Not needed, not issued. |
| OAuth 2.0 / OIDC | no | No authorization server on startbrain.io. |
| Web Bot Auth (HTTP message signatures) | not required | Signed requests are accepted like any other request; signatures are not verified. |
| Client certificates | no | |

## 3. Register

No registration. You do not have to declare your agent, your application or your organisation before calling the API. If you want to tell us you are building on it, write to contact@startbrain.io.

## 4. Claim and exchange

Not applicable: there is no credential to claim, no code to exchange, no token endpoint.

## 5. Use

Call the endpoints directly:

```
curl https://startbrain.io/api/v1/products?lang=en-us&limit=5
curl https://startbrain.io/api/v1/products/cybercup?lang=fr
curl "https://startbrain.io/ask?query=arcade+kiosk&lang=en-us"
```

Identify your agent in the `User-Agent` header if you can: it helps us understand agent traffic and keep these endpoints open. Bot user agents from the main AI vendors are allowed on the whole site (see `robots.txt`).

## 6. Errors

An authentication error cannot happen. The API itself never returns `401` or `403` (the Cloudflare edge in front of it may still block abusive traffic with a `403`). Errors you can get:

| Status | Meaning |
|---|---|
| 400 | Invalid parameter (`lang`, `limit`, `offset`, `theme`, `status`). |
| 404 | Unknown product or endpoint. |
| 405 | Method other than GET, HEAD, OPTIONS (the API is read-only). |
| 429 | Rate limit exceeded: 600 requests per 60 s per client IP, best effort per server instance (isolate), not global. Wait `Retry-After` seconds. |
| 503 | Generated data missing from the deployment. |

Every error body is an RFC 9457 problem details object (`application/problem+json`).

## 7. Revocation and rotation

Not applicable: nothing is issued, so nothing can be revoked or rotated.

## Scopes and permissions

The API has a single implicit scope: **read public data**. Nothing exposed by these endpoints is personal data or confidential: it is the content of the public website. There is no write operation, no purchase, no account creation and no data submission through the API. To act (sign up, book a meeting), agents send the user to the product page or to the booking page listed in each response.

## Contact

contact@startbrain.io · Brain Security SAS, Paris · https://startbrain.io/developers/