# steamgpt.net auth.md

> Agent registration discovery for https://steamgpt.net - a free public Steam data API. Anonymous by default (no accounts, no keys); an OPTIONAL self-service token - one POST, no humans in the loop - raises the rate limit.

## Agent audience

AI agents, applications and scripts consuming Steam identity and gaming context data (profiles, SteamID conversion, bans, FACEIT stats, friends, batch lookups, comparison) over HTTP or MCP.

## Authentication: anonymous by default

- No accounts, no cookies, no sessions; every endpoint works without any credential
- The MCP endpoint (https://steamgpt.net/mcp, Streamable HTTP) is auth-free
- Authorization is OPTIONAL: a valid Bearer boost-token raises the per-IP soft limit from 120 to 600 requests/min; an invalid token gets a proper OAuth 401 with `WWW-Authenticate` pointing at the resource metadata

## Registration (self-service, no humans in the loop)

There are no accounts to create. An agent provisions the optional boost token in ONE call - `client_credentials` with token endpoint auth method `none`:

```
curl -X POST https://steamgpt.net/oauth/token -d "grant_type=client_credentials"
```

```json
{"access_token": "eyJ...", "token_type": "Bearer", "expires_in": 3600, "scope": "rate-boost"}
```

Without a token, just call the API directly:

```
curl https://steamgpt.net/summary/76561197960287930.md
```

## Credential use

The boost token is a stateless ed25519-signed JWT (1h TTL, scope `rate-boost`), sent as `Authorization: Bearer ...`. There is no revocation - mint a fresh one when it expires. Minting extra tokens does NOT multiply limits: the ceiling is per IP. Anonymous fair use stays at 120 requests/min per IP (honor `Retry-After` on 429); responses are cached - repeat requests are cheap.

## Machine-readable flow metadata

```json
{
  "agent_auth": {
    "skill": "https://steamgpt.net/auth.md",
    "register_uri": "https://steamgpt.net/oauth/token",
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["urn:ietf:params:oauth:token-type:access_token"],
      "claim_uri": "https://steamgpt.net/oauth/token"
    }
  }
}
```

OAuth discovery documents:

- Protected Resource Metadata (RFC 9728): https://steamgpt.net/.well-known/oauth-protected-resource
- Authorization Server metadata (RFC 8414): https://steamgpt.net/.well-known/oauth-authorization-server (no `authorization_endpoint` - the only grant is `client_credentials`, which never uses it; the RFC allows omitting it in that case)
- JWKS: https://steamgpt.net/.well-known/jwks.json

Docs: https://steamgpt.net/docs.md | https://steamgpt.net/llms.txt | OpenAPI: https://steamgpt.net/openapi.json