# Authentication — NebulaKit

_Machine-readable summary of how to authenticate with this site._

## Short version

**Most of what an agent wants needs no authentication at all.** All published
content is publicly readable, and every page can be fetched as Markdown:

```sh
curl -H 'Accept: text/markdown' https://nebulakit.starspace.group/
```

Start at [https://nebulakit.starspace.group/sitemap.xml](https://nebulakit.starspace.group/sitemap.xml), and see the skills
index at
[https://nebulakit.starspace.group/.well-known/agent-skills/index.json](https://nebulakit.starspace.group/.well-known/agent-skills/index.json).

## Agent registration

**Not offered.** This deployment does not issue API keys, client credentials, or
agent identities, and has no registration endpoint. There is no
`/.well-known/oauth-authorization-server` and no
`/.well-known/oauth-protected-resource` here — deliberately, because this site
is an OAuth *client*, not an authorization server. Publishing that metadata
would point you at token endpoints that do not exist.

Do not probe for them. If you need access beyond public content, ask the site
owner (see "Contact" below).

## How human sign-in works

Authenticated areas (the admin console, `/profile`, the CMS and chat APIs) are
protected by a **session cookie**, established by a human logging in.

| Property   | Value                                       |
| ---------- | ------------------------------------------- |
| Cookie     | `session`                                   |
| Path       | `/`                                         |
| Flags      | `HttpOnly`, `SameSite=Lax`, `Secure` on HTTPS |
| Lifetime   | 7 days                                      |

Sign-in routes:

- `POST https://nebulakit.starspace.group/api/auth/login` — `{ "email", "password" }`. Returns `200`
  with a `Set-Cookie`, `400` if fields are missing, `401` on bad credentials.
- `POST https://nebulakit.starspace.group/api/auth/signup` — create an account.
- `GET https://nebulakit.starspace.group/api/auth/github`, `GET https://nebulakit.starspace.group/api/auth/discord` — begin an
  OAuth sign-in **with that provider as the identity source**. These are not
  endpoints this site issues tokens from.
- `POST https://nebulakit.starspace.group/api/auth/logout` — clear the session.

Because the cookie is `HttpOnly` and set by a login the user performs, an agent
can only act on authenticated surfaces while operating **inside an already
signed-in browser session** (for example a browser-extension agent, or WebMCP
tools running on the page — see below). There is no headless credential flow.

## Bearer tokens

Not supported. No endpoint on this site accepts an `Authorization: Bearer`
header. Sending one has no effect.

## In-browser tools (WebMCP)

When a user visits this site with a WebMCP-capable agent, the page registers
tools via `navigator.modelContext` for searching and reading content. Those
tools inherit the user's existing session and permissions — they grant no
additional authority.

## Rate limits and etiquette

- Crawl rules and content-usage terms: [https://nebulakit.starspace.group/robots.txt](https://nebulakit.starspace.group/robots.txt)
- Prefer `Accept: text/markdown` over scraping HTML; it is cheaper for both of us.
- Prefer `https://nebulakit.starspace.group/sitemap.xml` over crawling link-by-link.

## Contact

Reach the site owner through
[https://nebulakit.starspace.group/contact](https://nebulakit.starspace.group/contact), or programmatically via
`POST https://nebulakit.starspace.group/api/contact-form-submissions` (public; may require a Turnstile
token). See the `send-a-contact-message` skill for the full contract.