# PainSignal auth.md — agent access

PainSignal is a free, public, community-driven index of real business problems
that need software solutions. Reading it requires no credentials of any kind.

## Public read API — no authentication

These endpoints accept unauthenticated `GET` requests and return JSON. They are
also listed in [/.well-known/api-catalog](/.well-known/api-catalog).

| Endpoint | Returns |
| --- | --- |
| `/api/v1/signals` | Individual problems, each with an AI-generated app brief |
| `/api/v1/clusters` | Problems grouped into buildable product opportunities |
| `/api/v1/industries` | Industry taxonomy with signal counts |
| `/api/v1/categories` | Problem-category taxonomy with signal counts |
| `/api/v1/trends` | Rising, stable and declining problem themes |

Response envelope:

```json
{ "data": [], "meta": { "page": 1, "limit": 20, "total": 0 }, "error": null }
```

Paginate with `?page=` and `?limit=`. These read endpoints are not rate limited.
Please still fetch at a considerate pace.

Every HTML page also has a markdown twin — append `.md` to any path
(`/about` -> `/about.md`), or send `Accept: text/markdown`. Prefer markdown for
parsing; it is cheaper and the token count is advertised in `X-Markdown-Tokens`.

## MCP server — also unauthenticated

An MCP server is available at `https://painsignal.net/mcp` over streamable
HTTP (stateless JSON-RPC 2.0 via `POST`). It requires no credentials and
exposes read-only tools: `search_problems`, `search_opportunities`,
`get_trending_opportunities`, `list_industries`, `list_problem_categories`.

Server card: [/.well-known/mcp/server-card.json](/.well-known/mcp/server-card.json).

Requests are rate limited to 60 per minute per IP. There is no `GET` stream —
the server sends no unsolicited messages.

## There is no authorization server

PainSignal does **not** operate an OAuth 2.0 authorization server or an OpenID
Connect provider. It issues no API keys, no client credentials and no tokens to
third parties. The following endpoints are intentionally absent, and their
absence is correct rather than an oversight:

- `/.well-known/oauth-authorization-server`
- `/.well-known/oauth-protected-resource`
- `/.well-known/openid-configuration`

Do not attempt a client registration or authorization-code flow against this
origin. There is nothing to register with.

## Human sign-in is out of scope for agents

Accounts exist for people, not agents. Sign-in uses NextAuth with email/password
or GitHub and Google as upstream identity providers — PainSignal is an OAuth
*client* in that exchange, never the authorization server. Signed-in actions
(voting, commenting, build claims, saved items, workspaces) are session-cookie
based, rate limited, and not available programmatically.

If you need write access for a legitimate integration, contact a human:
[/contact](/contact).

## Terms

Content may be indexed, quoted and cited. See [/terms](/terms) and the
`Content-Signal` directive in [/robots.txt](/robots.txt), which permits
`search`, `ai-input` and `ai-train`.