# halfwhere auth.md

**No authentication is needed, and there are no accounts to register.** halfwhere (https://halfwhere.com) has no user accounts, logins, API keys or OAuth.

## Audience

AI agents and automated clients acting for people who want a fair place to meet in Australia: assistants, chat bots, browser agents and other agents (MCP, A2A or plain HTTP).

## Registration and provisioning

None. There is no registration or provisioning endpoint, and none is needed: every agent interface below is public. Don't try to sign up, and don't send email or identity assertions; nothing will be created.

## Supported methods

- **Anonymous (unauthenticated) access.** This is the only method. No identity, assertion or token is involved.

| Interface | Endpoint | Notes |
| --- | --- | --- |
| MCP server | `https://halfwhere.com/mcp` | Streamable HTTP, stateless. Tools: find_places_halfway, find_places_near, find_suburb. Card: /.well-known/mcp/server-card.json |
| A2A agent | `https://halfwhere.com/a2a` | JSON-RPC `message/send`. Card: /.well-known/agent-card.json |
| HTTP API | `GET https://halfwhere.com/api/venues` | OpenAPI: /openapi.json; catalogue: /.well-known/api-catalog |
| Pages as Markdown | any page, `Accept: text/markdown` | Sitemap: /sitemap.xml |

All of these are read-only and rate-limited per IP; on HTTP 429, wait a minute and retry.

## Credential use

There are no credentials. Send no `Authorization` header, cookies or API keys; they're ignored.

The one secret-like thing is a meetup link, `https://halfwhere.com/r/<room-id>#<key>`. The part after `#` is a 256-bit encryption key that never reaches the server; anyone with the full link can add a spot to that meetup. Treat it like a password the user chose to share: don't log it, store it, or pass it to third parties.

Agents can't create meetups server-side, by design: the key has to be generated in the browser. To start one, send the user to https://halfwhere.com, or use the `start_meetup` WebMCP tool when running in their browser.

## Machine-readable

- API catalogue (RFC 9727): /.well-known/api-catalog
- There is no OAuth protected-resource or authorization-server metadata, because no OAuth is used.