# Auth.md — Kaheli agent authentication

Kaheli does not currently register autonomous agents or issue OAuth/OIDC
credentials for agent access.

## Public agent-readable surfaces

- API catalog: https://kaheli.pl/.well-known/api-catalog
- MCP Server Card: https://kaheli.pl/.well-known/mcp/server-card.json
- Storefront Catalog MCP API: https://kaheli.pl/api/ucp/mcp
- UCP profile: https://kaheli.pl/.well-known/ucp
- OpenAPI discovery: https://kaheli.pl/openapi.json

The Storefront Catalog MCP API is a catalog discovery endpoint. It can be used
by compatible agents to browse products, collections, and storefront content.
It is not a payment or order-placement API.

## Authentication status

- Agent registration: not supported
- OAuth/OIDC token issuance: not supported
- Supported agent scopes: none
- Checkout: human Shopify-hosted checkout

Agents should deep-link users to Kaheli product pages and checkout surfaces
rather than attempting to buy products on a customer's behalf.