# Slingzero authentication for agents

Slingzero exposes a public, read-only Token Pages API and public discovery endpoints. These reads do not require an API key, bearer token, OAuth grant, identity assertion, cookie, registration, or payment. Slingzero does not advertise OAuth metadata because no protected agent resource is currently offered.

## Discover

Read the OpenAPI description at https://www.slingzero.com/openapi.json and the developer guide at https://www.slingzero.com/developers. Public Token Page reads are under https://www.slingzero.com/api/v1/token-pages. MCP discovery is at https://www.slingzero.com/.well-known/mcp/server-card.json.

## Pick a method

Use unauthenticated HTTPS GET for REST reads, Streamable HTTP JSON-RPC at /mcp for read-only tools, /a2a for A2A requests, or /ask for NLWeb-style list search. There is no OAuth scope to request for these public resources.

## Register

Registration is not supported or needed for public reads. There is no register_uri, agent_auth registration endpoint, anonymous credential, identity_assertion exchange, ID-JAG flow, or self-service API key. Agents must not fabricate an Authorization header or send credentials from another service.

## Claim

There is no claim ceremony for public data. Slingzero does not expose a claim_uri because public Token Page reads do not represent a user and cannot mutate user data.

## Use the credential

No credential is issued. Call the public endpoints without Authorization. Browser-based token creation and management are separate, transactional workflows: the person connects a compatible wallet, reviews the transaction, and signs it. A wallet signature is approval for the specific supported workflow; it is not an OAuth access token and must not be replayed as one.

## Errors

REST errors are JSON objects with a stable code, message, resolution hint, documentation URL, and request ID. A 400 indicates invalid input. A 404 covers both missing and non-public pages. A 503 indicates a temporary dependency problem and may include Retry-After. Because no protected REST resource is advertised, the public API does not return WWW-Authenticate.

## Revocation

There is no agent credential to revoke. A user can reject a pending wallet request or disconnect the site in their wallet. Completed blockchain transactions generally cannot be reversed. If Slingzero adds an authenticated agent API later, it will publish genuine RFC 9728 protected-resource metadata, RFC 8414 authorization-server metadata, scopes, registration, claim, error, and revocation endpoints before advertising that capability.

For integration questions, contact support@slingzero.com. Never send seed phrases, private keys, bearer tokens, wallet signature material, or other secrets by email.