# auth.md

## Authentication — mcp.getaxionlabs.com

**None.** The Axion Gateway is free: no registration, no API key, no OAuth, no token exchange.

- `POST https://mcp.getaxionlabs.com/mcp` (MCP, Streamable HTTP) works anonymously.
- There is no `/.well-known/oauth-authorization-server` and no `/.well-known/oauth-protected-resource` on this host, because there is no OAuth server behind it. Those paths answer 404 on purpose.
- Terms: free with attribution and a link to the source zone named in each tool's payload (the `cite` object). Fair use is 60 requests per minute per IP, enforced; excess answers HTTP 429 with `retry-after`.
- Bulk pulls of a whole dataset are a priced door on each data site (`/api/bulk`), currently dormant (HTTP 402 with an empty `accepts[]`); when a rail is live it will be a prepaid key, never OAuth. Ask: hello@getaxionlabs.com.

Passport: https://mcp.getaxionlabs.com/.well-known/agent-door.json · Server card: https://mcp.getaxionlabs.com/.well-known/mcp/server-card.json