# coach steve authentication

coach steve's public interfaces are open and read only. No account, key or token is needed, and none can be issued. In the terms of the auth.md spec, the only identity type is anonymous, and it needs no registration: there is no agent_auth block, identity_endpoint or claim_endpoint to call.

## Discover

- REST API: https://getcoachsteve.com/api/v1, described by https://getcoachsteve.com/openapi.json
- Product MCP server: https://getcoachsteve.com/mcp (Streamable HTTP POST)
- Docs MCP server: https://getcoachsteve.com/mcp/docs (Streamable HTTP POST)
- Race API: https://getcoachsteve.com/api/races/v1, described by https://getcoachsteve.com/api/races/v1/openapi.json
- API catalog: https://getcoachsteve.com/.well-known/api-catalog

There is no /.well-known/oauth-protected-resource or /.well-known/oauth-authorization-server metadata, because no resource here is protected, and no endpoint answers 401 with WWW-Authenticate.

## Pick a method

Anonymous. There is no OAuth flow, API key, service credential or identity assertion to choose.

## Register

Nothing to register.

## Claim

Nothing to claim.

## Exchange

Nothing to exchange.

## Use the access_token

There is no token. Call the APIs and the MCP tools with no Authorization header. Race data is free to reuse under CC BY 4.0 with a link to the race's page; every race answer carries its attribution.

## Errors

The API answers JSON: `{"error": {"code": "...", "message": "...", "hint": "..."}}`. A 400 names the parameter at fault in `field`; a 404 is an unknown address, article or race; a 503 from the race API means the race index is not available right now, so retry later. The MCP servers answer a bad call with a JSON-RPC error. No endpoint answers 401, because none asks for credentials.

## Revocation

Nothing to revoke. Athlete accounts are not reachable through these interfaces.