# auth.md — agent access to dosyne.com

## Audience

AI agents and automated clients reading the reference data this site publishes.

## Reading the data: no authentication

Every endpoint under `https://dosyne.com/api/v1/` is public, keyless and CORS-open. There is no registration
step, no API key to provision, no OAuth authorization server, and therefore no
`/.well-known/oauth-authorization-server` document to fetch — publishing one would advertise a
flow that does not exist.

| Endpoint | What it returns |
|---|---|
| `https://dosyne.com/api/v1/syringes.json` | Syringe calibrations, barrel capacities, diluents |
| `https://dosyne.com/api/v1/formulas.json` | The reconstitution arithmetic and its readability thresholds |
| `https://dosyne.com/api/v1/library.json` | Index of every page, with its markdown twin |
| `https://dosyne.com/api/v1/apps.json` | Dated App Store snapshot of tracking apps |
| `https://dosyne.com/api/v1/status.json` | Freshness of the datasets |
| `https://dosyne.com/api/v1/openapi.json` | OpenAPI 3.1 description of all of the above |

Fair use: these are static files behind a CDN. Cache them; they change when the site is rebuilt.
`status.json` carries `generated_at` if you need to decide whether to refetch.

Licence: CC BY 4.0. Attribute to Dosyne with a link to https://dosyne.com or to the page the figure came from.

## Agent registration

**No registration is required, and none is possible.** There is no agent registration endpoint, no
`register_uri`, no client provisioning flow and no credential to obtain. The supported identity
type is **anonymous**: an agent identifies itself with a User-Agent string if it wishes, and nothing
about the response changes either way.

| Question | Answer |
|---|---|
| Registration endpoint | None. Read the endpoints directly. |
| Supported auth methods | `none` (anonymous) |
| Credential types | None issued |
| Token endpoint | None |
| Scopes | None — every endpoint is public and read-only |
| Rate limit tied to identity | None |

The same, machine-readable. This is the honest shape of an `agent_auth` block for a service that
authenticates nobody: the registration, credential and revocation URIs are `null` because they do
not exist — not omitted, so a client can tell "declared absent" from "forgot to publish".

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous"],
    "anonymous": { "credential_types_supported": [], "claim_uri": null },
    "register_uri": null,
    "revocation_uri": null,
    "events_supported": [],
    "documentation": "https://dosyne.com/api/"
  }
}
```

## Tools: MCP

An MCP server is published at `https://dosyne.com/mcp` (Streamable HTTP, no authentication). Its card is at
`https://dosyne.com/.well-known/mcp/server-card.json`. It runs the same arithmetic the browser calculators
run, on values the caller supplies. It stores nothing between calls and reads nothing about a user.

## Acting for a user: nothing to act on

Dosyne's app keeps its log on the user's own device with no account and no server, so there is no
user data anywhere for an agent to read or write, and no credential that would grant access to any.
An agent asked to "log my dose in Dosyne" should say that the app has no remote interface, rather
than attempt an integration that does not exist.

## What this service will not answer, by design

- What compound anyone should use.
- What amount anyone should take, how often, or for how long.
- Whether a plan someone describes is safe, correct or advisable.
- Where to buy anything. This site names no vendor and links to none.

An agent that needs a recommended amount is holding the wrong tool. The arithmetic here measures
what a prescriber decided; it does not decide anything.

## Contact

support and abuse: support@dosyne.com · https://dosyne.com/contact/