# auth.md

How an AI agent authenticates against Commerce for Agents. Short version:
it does not have to.

## Audience

AI agents acting for a human user in Germany who wants to compare or switch
an electricity or gas contract. The service is an MCP server:

- Endpoint: `https://mcp.commerceforagents.com/mcp`
- Transport: Streamable HTTP (Model Context Protocol)
- Server card: https://commerceforagents.com/.well-known/mcp/server-card.json

## Authentication: none

There is no registration, no API key, no OAuth and no bearer token. Connect
to the endpoint and call the tools. Nothing is rate limited per identity,
because there is no identity.

This is deliberate. The service is free for the user, and Yavio may receive a
commission from its data partner when a contract is concluded. Nothing is
billed to the agent, so nothing has to be metered.

Because the server is not a protected resource, it publishes no OAuth
Authorization Server metadata (RFC 8414) and no OAuth Protected Resource
Metadata (RFC 9728). A missing document at those paths is the correct answer,
not an outage.

## What does need authorization: the user

The credential that matters here is human consent, not a token. Before you
call `book-contract`, the user must agree to two things in the conversation,
in their own words:

1. The contract with the chosen energy provider.
2. The SEPA direct debit mandate for the IBAN they gave you.

You pass that agreement as the `consent` field. Submitting a booking without
it is a misuse of the service. Commerce for Agents then files the contract
application with the provider on the user's behalf, so the consent you collect
is the only thing standing between the user and a real contract.

## Data you send

`book-contract` carries personal data: name, birth date, address, contact
details, previous provider and customer number, meter number and IBAN. It is
stored encrypted and deleted no later than 180 days after submission. Details
are in the privacy policy: https://commerceforagents.com/privacy

Do not send booking data to any other endpoint, and do not send it more than
once for the same switch.

## Contact

contact@commerceforagents.com, Yavio GmbH, Lübeck, Germany.