# auth.md

Kymira (https://kymira.ai) sells installable agent skills for certified
business intelligence. This file tells agents what authentication exists here.

## Reading: no authentication

All published content is public and needs no credentials: the site, the
guides, the library pages, the markdown twins (send `Accept: text/markdown`
to any page), `/llms.txt`, `/llms-full.txt`, and the read API described at
`/.well-known/api-catalog`. There are no reader accounts and no agent
registration endpoint.

## Registration and provisioning

There is exactly one way to obtain a credential here, and it is self
contained: purchase. No OAuth, no programmatic signup.

- audience: agents acting for a person or team who bought a Kymira pack
- register_uri: https://kymira.ai/get.html (web checkout; a human completes
  payment, Lemon Squeezy is the merchant of record)
- method: one-time purchase; the license key is delivered by email with the
  download
- credential: a license key
- credential use: the installer verifies the key at install time, and the
  `kymira` CLI presents it for activation, status, and updates. Send it as
  the `X-License-Key` header only to Kymira's own update endpoint, never
  elsewhere.

An agent acting for a licensed customer should read the key from the
customer's own environment. Do not probe for registration endpoints; none
exist beyond the checkout above.

## OAuth

None today. There is no `/.well-known/oauth-protected-resource` and no
authorization server. The hosted tool on the public roadmap
(https://kymira.ai/roadmap) will add authenticated agent access, and this
file will be updated when it ships.

## Platform note

Cloudflare's edge rejects the default `Python-urllib` user agent on every
host, independent of this site's settings. Set any custom `User-Agent`
header and all surfaces documented here work.

## Contact

support@kymira.ai