# auth.md — Brazilian Finance

**Audience:** AI agents and automated clients acting on a user's behalf, plus the developers integrating
them. This document is the authoritative answer to "what on this site needs credentials, and how do I get
them?" There is **no OAuth authorization server** here — see *Authenticated: the partner syndication feed*
below for the one credential that exists and how it is issued.

Most of this site needs no credentials at all. One resource is licensed and authenticated.

## No authentication required

These are open to any client, including automated agents. Please send a descriptive `User-Agent`.

| Resource | Notes |
|---|---|
| Every page on https://brazilianfinance.com | Add `Accept: text/markdown` to any page URL for a clean Markdown rendition |
| `POST https://brazilianfinance.com/api/mcp` | MCP server (Streamable HTTP, JSON-RPC 2.0). Read-only tools |
| `GET https://brazilianfinance.com/api/market-bar` | Live market snapshot |
| `GET https://brazilianfinance.com/api/jsonld?path=` | Schema.org graph of any page |
| `GET https://brazilianfinance.com/search?q=` | Site search results page |
| `GET https://brazilianfinance.com/llms.txt` | Full content index |

Rate limits apply at the edge. They are set well above any legitimate agent's usage; if you receive a
`429`, back off and retry rather than rotating addresses.

## Authenticated: the partner syndication feed

`GET https://brazilianfinance.com/api/partner/feed.xml` (RSS 2.0) and `GET https://brazilianfinance.com/api/partner/feed.json` (JSON Feed 1.1)
serve a licensed **excerpt** of every published article — the lead paragraphs, the heading outline with deep
links, and the canonical URL — for commercial partners who republish.

### Credentials

An API key has the form `bf_<slug>_<secret>`. Send it either way:

- **Basic** (preferred): `Authorization: Basic base64(<slug>:<key>)`. RSS readers that accept a
  `https://slug:key@host/feed.xml` URL will construct this header for you, which keeps the secret out of
  the URL.
- **Bearer**: `Authorization: Bearer <key>`

Never place the key in a query string or a path segment — both end up in CDN and proxy logs.

### How to obtain one

**There is no self-service registration, and no OAuth flow.** Keys are issued manually as part of a
syndication licence agreement.

To request one, contact us at https://brazilianfinance.com/about#contact with your organisation, the destination site, and the
intended volume. An agent acting on someone's behalf should surface this to its user rather than attempting
to register automatically — there is no endpoint to register against.

### Licence

The feed is excerpt-only. Republishing the excerpt with attribution and a canonical link is permitted under
the agreement; reproducing full articles is not. Full terms accompany the key.

## Content usage for AI systems

Index us, and use our content to ground and cite an answer — with attribution and a link. Do not use it as
model training data. AI crawlers are explicitly allowed in `https://brazilianfinance.com/robots.txt`; the usage terms above are
stated here and at https://brazilianfinance.com/about#contact.

## Discovery

- API catalog: https://brazilianfinance.com/.well-known/api-catalog
- OpenAPI: https://brazilianfinance.com/openapi.json
- Protected resource metadata: https://brazilianfinance.com/.well-known/oauth-protected-resource
- MCP server card: https://brazilianfinance.com/.well-known/mcp/server-card.json
- Agent skills: https://brazilianfinance.com/.well-known/agent-skills/index.json