# auth.md

Agent authentication and registration guide for **presengage.com**.

## Audience

AI agents and automated clients that want to search or ask questions about
PresEngage — an AI-powered audience-engagement and live-Q&A platform — including
its product, pricing, integrations, and documentation.

## Endpoints

| Interface | URL | Transport | Machine-readable card |
| --- | --- | --- | --- |
| MCP server | `https://presengage.com/mcp` | Model Context Protocol (SSE) | `/.well-known/mcp/server-card.json`, `/.well-known/mcp.json` |
| Ask (NLWeb) | `https://presengage.com/ask` | HTTP | `/.well-known/agent-card.json` |

The `/ask` endpoint accepts a `query` and an optional `generate_mode`
(`list` \| `summarize` \| `generate` \| `none`) and returns ranked results or a
generated answer over PresEngage content.

## Authentication

The search and Q&A interface is **public and read-only — no registration,
account, sign-up, or credentials are required** to call `/mcp` or `/ask`.

For agents that want to send **verified, signed requests**, PresEngage publishes
an **Ed25519** verification key for **HTTP Message Signatures**
([RFC 9421](https://www.rfc-editor.org/rfc/rfc9421)) at
`/.well-known/http-message-signatures-directory`. Signing is **optional** —
unsigned requests are accepted for the public read-only interface.

## Identity & credential types

- **Anonymous** *(default)* — no credentials needed for public search/Q&A.
- **HTTP Message Signature** *(optional)* — Ed25519; verification keys are
  published at `/.well-known/http-message-signatures-directory`.

There is no agent-registration step and **no OAuth**: the read-only interface is
open. Connect to `https://presengage.com/mcp` directly — send no `Authorization`
header and expect no `WWW-Authenticate` challenge.

We deliberately publish **no** `oauth-protected-resource`,
`oauth-authorization-server`, or `openid-configuration` document. Those files
existed until 2026-07-29 and were removed because they broke real clients: under
RFC 9728 a published `oauth-protected-resource` tells a spec-compliant client the
resource *is* OAuth-protected, so MCP clients (Claude among them) would start an
authorization-code flow against `/oauth/authorize` and `/oauth/token`, which were
advertised but never implemented and returned 404. The metadata was decorative in
intent and load-bearing in effect. Do not reintroduce it unless a real
authorization server, including an RFC 7591 `registration_endpoint`, exists first.

## Good-citizen guidance

Identify your agent with a descriptive `User-Agent`, cache responses, respect
[`/robots.txt`](https://presengage.com/robots.txt), and use the interface for
product/documentation discovery rather than bulk scraping.

## Contact

`hello@presengage.com`