# SkillsMP auth.md

SkillsMP exposes a public catalog of Agent Skills and a read-only API for agents. Anonymous access is available for basic search. Higher quotas use a free API key generated by the owning human from the developer portal.

## 1. Discover

Use these machine-readable discovery documents:

- API catalog: https://skillsmp.com/.well-known/api-catalog
- OpenAPI: https://skillsmp.com/openapi.json

## 2. Choose an access mode

Anonymous agents can call the public keyword search endpoint with lower quotas.

Agents that need higher quotas should ask the user to sign in and create an API key:

1. Open https://skillsmp.com/developers
2. Sign in with a supported account.
3. Generate a free API key.
4. Store the key in the agent's secret manager.

Google or GitHub sign-in is only used by a human owner to create and manage an API key. SkillsMP does not provide Agent OAuth token exchange, dynamic client registration, identity assertions, service authentication, or a claim flow. Use human-in-the-loop API key provisioning.

## 3. Available API access

- Anonymous requests can search public Agent Skills with lower quotas.
- A human-managed API key raises the documented search quotas.
- API keys are read-only product credentials, not scoped OAuth access tokens.

## 4. Use the credential

Send API keys in the `Authorization` header:

```http
Authorization: Bearer sk_live_skillsmp_your_api_key
```

Do not put API keys in URLs, query strings, browser-exposed client code, or logs.

## 5. Revocation

The user can revoke or regenerate an API key from the developer portal:

https://skillsmp.com/developers

After revocation, agents should stop using the old key and ask the user to provision a new one.

## 6. Contact and policy

- Documentation: https://skillsmp.com/developers
- Pricing: https://skillsmp.com/pricing
- Terms: https://skillsmp.com/terms
- Privacy: https://skillsmp.com/privacy