# auth.md — iGregulator API authentication for agents

This document tells autonomous agents how to authenticate with the iGregulator
API. iGregulator is an iGaming licensing-intelligence API + MCP server. It uses
**bearer API keys**, not OAuth — there is no authorization server, so the
`/.well-known/oauth-*` discovery documents do not apply.

## Audience

Agents (and the developers running them) that need machine-readable iGaming
operator-licence data: compliance/AML teams, payment providers, affiliate
networks, and investment-intelligence desks.

## Do I even need a key?

No, to start. Public endpoints work **without credentials**, rate-limited to
**10 requests per IP per hour**. They cover licence verification, operator
search, and jurisdiction coverage. A key unlocks higher quotas, per-operator
detail, and regulatory-action history.

## Getting a credential

1. Provision a key in the dashboard: <https://app.igregulator.io/api-keys>
   (self-serve; create an account, generate a key — no sales contact required).
2. Store it securely. Keys are long-lived bearer tokens; treat them as secrets.

There is no automated/dynamic client-registration endpoint. Do **not** attempt
to register programmatically — provisioning is interactive via the dashboard
above.

## Using the credential

Send the key as a bearer token on every request:

```
Authorization: Bearer YOUR_API_KEY
```

- **Method:** HTTP bearer token (`Authorization` header). This is the only
  supported method.
- **REST base URL:** `https://api.igregulator.io` (OpenAPI:
  <https://api.igregulator.io/openapi.json>)
- **MCP server:** `https://mcp.igregulator.io/mcp` (Streamable HTTP; same bearer
  key, see <https://igregulator.io/docs/mcp>)

## Rate limits & errors

- Unauthenticated: 10 req/IP/hour. Authenticated tiers raise this — see
  <https://igregulator.io/docs/rate-limits/>.
- `401` means a missing/invalid key; `429` means you exceeded your quota
  (respect the `Retry-After` header).

## More

- API docs: <https://igregulator.io/docs/>
- For-AI-agents guide: <https://igregulator.io/docs/for-ai-agents/>
- Authentication guide: <https://igregulator.io/docs/authentication/>