# Authentication: Cork & Curve agent API

No sign-in and no OAuth. The REST API and the MCP server are public.

- REST API: https://corkandcurve.com/api/v1/ (OpenAPI: https://corkandcurve.com/api/v1/openapi.json, docs: https://corkandcurve.com/api/v1/docs)
- MCP server: https://corkandcurve.com/mcp (streamable HTTP; manifest: https://corkandcurve.com/.well-known/mcp.json)
- API catalog (RFC 9727): https://corkandcurve.com/.well-known/api-catalog

## Anonymous use

No key is needed. Every request is counted against a per-IP limit (120 a
minute); a refused request gets HTTP 429 with Retry-After.

## Optional API key

A key gives your agent its own attribution tag on the booking links it
hands out and its own rate limit. Send it as the `X-API-Key` header (or
the `api_key` query parameter). Keys are issued by us on request through
https://corkandcurve.com/contact/ ; there is no self-serve sign-up.

## Terms

https://corkandcurve.com/agents/#terms