# auth.md

THORChain Swap publishes public discovery metadata for agents.

## Audience

This document is for agents and developers inspecting the public THORChain Swap web interface and its public support APIs.

## Current Authentication Model

The public web interface does not require account authentication for browsing.
Wallet connection and transaction signing are performed by user-controlled wallets in the browser; memoless ("instant") swaps work without connecting a wallet.

The swap aggregator backend that powers the UI (https://api.thorchain.org/v1) requires an `x-api-key` header; keys are not self-service — coordinate with the THORChain Swap maintainers.
The memoless API (https://api.thorchain.org/memoless/api/v1) requires no API key.
Keyless access to quotes, pools, and network data is also available through the MCP server at https://swap.thorchain.org/mcp.

The public support APIs documented in the API catalog are unauthenticated at the HTTP layer and enforce per-client rate limits.
The public MCP server at https://swap.thorchain.org/mcp is likewise unauthenticated and rate limited.
There is no public self-service OAuth credential issuance for agents at this time, and the OAuth endpoints below respond with errors until issuance is enabled.

## Scopes

The OpenAPI description (https://swap.thorchain.org/.well-known/openapi.json) declares an OAuth 2.0 security scheme with least-privilege scopes, matching the authorization server metadata:

- `read:public` — read public discovery documents, quotes, pools, and network data.
- `submit:feedback` — submit newsletter subscriptions and bug reports.

Anonymous access is currently permitted for everything these scopes cover; agents should still request only the scopes they need once issuance is enabled.

## Discovery Metadata

- OAuth authorization server metadata: https://swap.thorchain.org/.well-known/oauth-authorization-server
- OAuth protected resource metadata: https://swap.thorchain.org/.well-known/oauth-protected-resource
- API catalog: https://swap.thorchain.org/.well-known/api-catalog
- MCP server card: https://swap.thorchain.org/.well-known/mcp-server-card

## Agent Registration

Self-service agent registration is not currently enabled.
Teams that need authenticated integration access should coordinate with the THORChain Swap maintainers.

## More

Full developer documentation lives at https://swap.thorchain.org/developers (markdown: https://swap.thorchain.org/developers.md).