# auth.md

ExhibitSet does not register agents. This file says so in the place an agent
looks for the answer, so it can stop here instead of probing endpoints.

## Who this is for

Autonomous agents acting for a person who has an ExhibitSet account, and
crawlers working out whether there is an API to sign up for.

## Registration

There is none. ExhibitSet has no agent registration endpoint, no client
registration, no provisioning endpoint and no API keys. Nothing here will issue
an agent a credential of its own.

## Supported methods

None. There is no OAuth authorization server, so there is no
`/.well-known/oauth-authorization-server` and no
`/.well-known/oauth-protected-resource` document to fetch. People sign in with
a six-digit code sent to their e-mail address, or with a passkey. The session
that results belongs to the browser that signed in, and requests that change
anything are checked against the application's own origin, so it is not
something that can be handed to anything else. The one exception to the origin
check is Stripe's webhook, which is verified by its signature instead.

## What is available without credentials

- The API catalog: <https://exhibitset.com/.well-known/api-catalog>
- Its OpenAPI 3.1 description: <https://exhibitset.com/.well-known/openapi/accounts.json>
- What the API is and is not: <https://exhibitset.com/api/>
- Any page as Markdown: request it with `Accept: text/markdown`
- A short index of the site: <https://exhibitset.com/llms.txt>
- On the API itself, two open endpoints: `/health`, and `/.well-known/entitlement-key`,
  the public key that verifies the offline entitlement tokens the application
  issues to people who have signed in. Both are in the OpenAPI description above.

## Why there is nothing more

ExhibitSet processes documents in the browser and never uploads them. The
account service holds plans, matters, Bates prefixes and reserved number
ranges, and no route accepts a file. An agent that could drive ExhibitSet would
need the documents somewhere it could reach them, which is the one thing this
product promises never happens.

## The human path

Write to <hello@exhibitset.com> and say what you would connect. If a
third-party programme is ever built, it will be described at
<https://exhibitset.com/api/> and listed in the catalog above.

Last reviewed 2026-09-06.