# Authentication & Access Policy

_Kobayashi Bar — https://kobayashibar.com_

## Public API

The Kobayashi Bar API is hosted at **`https://kobayashi-api.onrender.com`** and
described by an OpenAPI document at
[`/.well-known/openapi.json`](https://kobayashibar.com/.well-known/openapi.json)
(also discoverable via [`/.well-known/api-catalog`](https://kobayashibar.com/.well-known/api-catalog)).

**No authentication is currently required** for the public endpoints
(pricing calculation, tax estimate, quote email, and lead/order capture). You can
call them directly with a JSON request body.

Please be reasonable: these endpoints back a small business website. Send a
descriptive `User-Agent`, avoid high request rates, and don't submit spam leads.

## Agent capabilities

- **WebMCP** — every page exposes in-browser tools through
  `navigator.modelContext` (book a design session, get a quote, list products,
  open a guide). An MCP-aware browser/agent can use these directly.
- **Agent Skills** — see
  [`/.well-known/agent-skills/index.json`](https://kobayashibar.com/.well-known/agent-skills/index.json).
- **Site overview for agents** — see
  [`/llms.txt`](https://kobayashibar.com/llms.txt).

## OAuth / OIDC (reserved — not live yet)

OAuth 2.0 / OIDC discovery documents are published as **placeholders** for a
future authenticated tier (e.g. partner/dealer access):

- [`/.well-known/oauth-authorization-server`](https://kobayashibar.com/.well-known/oauth-authorization-server)
- [`/.well-known/oauth-protected-resource`](https://kobayashibar.com/.well-known/oauth-protected-resource)
- [`/.well-known/openid-configuration`](https://kobayashibar.com/.well-known/openid-configuration)

These are marked `"x-status": "planned"`. The `/oauth/*` endpoints they reference
are **not active** and will return 404 until that tier ships. Until then, treat
the API as open.

## Contact

For partner/dealer/API access or anything else: **info@kobayashibar.com**.