# Authentication

*QuantoNetto.Com - last updated 2026-09-05 - canonical: https://quantonetto.com/auth.md*

**There is no authentication.** The REST API and the MCP server are public,
keyless and anonymous. If you are looking for a token endpoint, stop: there
isn't one, and its absence is deliberate rather than an oversight.

This document exists so an agent following an auth-discovery chain gets a
definitive answer instead of inferring one from a series of 404s.

## Discover

No protected-resource metadata is published at
`/.well-known/oauth-protected-resource`, and no authorization-server metadata at
`/.well-known/oauth-authorization-server`, because no resource here is
protected and no authorization server exists. Those paths return 404, and that
404 is the correct answer rather than a misconfiguration.

The surfaces you can call are listed in
[/.well-known/ard.json](https://quantonetto.com/.well-known/ard.json) and described in
[/llms.txt](https://quantonetto.com/llms.txt).

## Pick a method

The method is: send the request. No `Authorization` header, no bearer token, no
`agent_auth` block, no identity assertion, no client credentials.

## Register

No registration. There is no client to register, no account to create, and no
dynamic client registration endpoint.

## Claim

Nothing to claim. Requests are not tied to an identity, and no per-caller state
is kept on the server.

## Exchange

No token exchange. Nothing is issued because nothing is required.

## Use the access_token

There is no `access_token`. Call the endpoints directly:

```bash
curl "https://quantonetto.com/api/comuni?q=milano"

curl -X POST "https://quantonetto.com/api/mcp" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

For an MCP client, configure the server with no auth block:

```json
{
  "mcpServers": {
    "quantonetto": {
      "type": "streamable-http",
      "url": "https://quantonetto.com/api/mcp"
    }
  }
}
```

## Errors

No request will ever fail for an authentication reason. There are no 401 and no
403 responses on any public endpoint, and none carrying `WWW-Authenticate`.

Failures you can get are ordinary and described in the
[OpenAPI document](https://quantonetto.com/openapi.json): `400` for a malformed request,
`404` for a comune that does not exist, `503` when the upstream exchange-rate
provider is unreachable. Each is RFC 9457 problem+json and carries a stable
`code` plus a `hint` naming the next request to make.

An MCP tool call that fails returns a normal JSON-RPC result with
`isError: true` and the reason in its content, so you can correct the arguments
and retry.

## Revocation

Nothing to revoke. No credential is issued, so none can leak and none needs
rotating.

## Rate limits

None are enforced by this application. Traffic passes through a content
delivery network that may throttle abuse. Responses carry real `Cache-Control`
headers; honouring them is the whole of the contract.