# auth.md

LPD has an **open data plane** and a **token-gated control plane**.

- **Public (no auth):** `https://lpd.conde.sh/product/{n}` (HTML + Markdown), `/llms.txt`, `/llms-full.txt`, `/sitemap.xml`, `/openapi.json`, the `/.well-known/*` agent surface, and the **MCP server at `https://lpd.conde.sh/mcp`** (read-only tools).
- **Token-gated (`/v1/*`):** the REST API + chat. Send `Authorization: Bearer <API_TOKEN>`. A Cloudflare Access JWT is also accepted.

resource: https://lpd.conde.sh
bearer_methods_supported:
  - header
scopes_supported:
  - read

agent_auth:
  audience: Autonomous agents and scripts that need the structured `/v1` REST API or the chat endpoint.
  skill: LEGO set lookup, catalog search, and dated multi-source review aggregation.
  register_uri: mailto:matt.conde@gmail.com?subject=LPD%20API%20token%20request
  methods:
    - type: bearer
      token_location: header
      header: Authorization
      format: Bearer <API_TOKEN>
      provisioning: Tokens are issued manually — request one from the operator at the register_uri above. There is no self-serve registration and no OAuth flow.
      credential_use: Send on every `/v1/*` request as `Authorization: Bearer <API_TOKEN>`. A Cloudflare Access JWT is also accepted where Access is enabled.

LPD does **not** run an OAuth server; the bearer token above is the only credential for `/v1/*`. The data plane (product pages, Markdown, `llms.txt`) and the MCP read tools need no credential.