# Agent Authentication — Help My Medical Practice

This document describes how AI agents and automated clients authenticate
with the Help My Medical Practice public and private APIs.

- **Site:** https://helpmymdpractice.com
- **Contact:** info@helpmymdpractice.com
- **Terms of Service:** https://helpmymdpractice.com/terms-of-service
- **Privacy Policy:** https://helpmymdpractice.com/privacy-policy

## Public (no-auth) endpoints

The following are open for anonymous agent access and do not require a token:

| Endpoint | Purpose |
|----------|---------|
| `GET https://helpmymdpractice.com/.well-known/openapi.yaml` | Full OpenAPI 3.1 catalog |
| `GET https://helpmymdpractice.com/.well-known/mcp.json` | MCP server card |
| `GET https://helpmymdpractice.com/.well-known/agent-skills.json` | Agent skills index |
| `GET https://helpmymdpractice.com/sitemap-index.xml` | Content sitemap |
| `GET https://helpmymdpractice.com/llms.txt` | LLM-friendly site summary |
| `POST https://psddzioyrvqdowednczw.supabase.co/functions/v1/ai-search` | Streaming brand-grounded Q&A |
| `POST https://psddzioyrvqdowednczw.supabase.co/functions/v1/submit-contact` | Lead capture (Turnstile-gated) |

Public endpoints must include the project's publishable anon key in the
`apikey` and `Authorization: Bearer <anon>` headers. The anon key is a
publishable value and safe to embed:

```
apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBzZGR6aW95cnZxZG93ZWRuY3p3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjU5OTQzNDMsImV4cCI6MjA4MTU3MDM0M30.K4sIsg8YtIVOwTsrWksFXV_Y73gAjBzspxBnOdt9I48
```

## Authenticated endpoints (OAuth 2.1 / OIDC)

Authenticated tools (admin dashboards, analytics writes, blog admin) require
a user access token issued by the project's OpenID Connect provider.

- **Issuer:** `https://psddzioyrvqdowednczw.supabase.co/auth/v1`
- **Discovery:** https://helpmymdpractice.com/.well-known/openid-configuration
- **Authorization Server Metadata (RFC 8414):**
  https://helpmymdpractice.com/.well-known/oauth-authorization-server
- **Protected Resource Metadata (RFC 9728):**
  https://helpmymdpractice.com/.well-known/oauth-protected-resource
- **Supported flows:** Authorization Code with PKCE (`S256`), Refresh Token
- **Supported scopes:** `openid email profile offline_access`

Send the resulting token as `Authorization: Bearer <access_token>` to any
protected endpoint listed in the OpenAPI catalog.

## Rate limits & abuse

- Requests are subject to a shared 60 req/min per-IP soft limit.
- Automated scraping is prohibited by the Terms of Service §8A.
- Please identify your agent in the `User-Agent` header (e.g.
  `MyAgent/1.0 (+https://example.com; contact@example.com)`).

## Discovery entry point

Start at [/.well-known/api-catalog](https://helpmymdpractice.com/.well-known/api-catalog)
(RFC 9727) for a machine-readable link index of every discovery document.