# auth.md — Egypt Gate

**No authentication is required.** Everything Egypt Gate exposes to agents is a
public, read-only catalogue. There is no sign-up, no API key, no OAuth flow, and no
rate-limit token. Call the endpoints directly.

## Agent audience

This document is for autonomous agents, assistants and partner integrations that want to
search the Egypt Gate catalogue of tours and activities in Egypt and refer travellers
to a booking page. Any agent may use it. No allow-list, no registration, no identity.

| Surface | URL | Auth |
| --- | --- | --- |
| REST API | `https://www.egyptgate.net/api/v1` | none |
| MCP server | `https://www.egyptgate.net/api/mcp` | none |
| OpenAPI description | `https://www.egyptgate.net/openapi.json` | none |
| API catalog | `https://www.egyptgate.net/.well-known/api-catalog` | none |
| Agent Skills | `https://www.egyptgate.net/.well-known/agent-skills/index.json` | none |
| Markdown pages | any page with `Accept: text/markdown` | none |

## Registration and provisioning

There is **no self-service registration endpoint**, because there is nothing to register
for: every agent-facing surface above is anonymous. Requests to a `register_uri` would
have nothing to issue.

Provisioning exists only for contracted B2B partners — resellers, OTAs and travel
agencies that need write access (live availability, net rates, booking creation). That is
a commercial agreement, not an automated flow, and credentials are issued out of band:

- Contact form: https://www.egyptgate.net/en/contact
- WhatsApp: https://wa.me/201006110456

Include your company, the markets you sell in, and the volume you expect.

## Supported methods

| Method | Status |
| --- | --- |
| Anonymous / no credential | **Supported** — the only method for the public API and MCP server |
| OAuth 2.0 / OIDC | Not offered. `/.well-known/oauth-authorization-server`, `/.well-known/openid-configuration` and `/.well-known/oauth-protected-resource` are deliberately **not** published, because no authorization server backs them. A `401` from any endpoint listed above is a bug — report it rather than starting an OAuth flow. |
| API key / bearer token | Not offered for public access. Issued only under a signed B2B agreement, out of band. |
| Dynamic client registration | Not offered. |

Staff and B2B portal sessions on this site use Firebase Authentication
(issuer `https://securetoken.google.com/tourivo`), which is an internal human sign-in
for the dashboard — it is not an agent surface and no agent should attempt it.

## Credential usage

Because no credential is issued, none is sent. Do not attach an `Authorization` header
to the endpoints above; it is ignored. Do not ask a traveller for card details, account
passwords or booking-reference credentials on Egypt Gate's behalf.

Partner credentials, where they exist, are bearer tokens presented in the
`Authorization: Bearer <token>` header on the private partner host named in the
agreement. They are never valid on the public endpoints above.

## What agents may do

- Read the catalogue, cache it, and quote prices, durations and ratings from it.
- Send travellers to the `bookingUrl` of any activity.
- Request any page of https://www.egyptgate.net as markdown with `Accept: text/markdown`.

## What agents may not do

- Create, modify or cancel a booking. There is no booking API; bookings are made by the
  traveller on the website.
- Take payment, or ask a traveller for card details on Egypt Gate's behalf.
- Use the catalogue to train a model — see the `Content-Signal` directives in
  [`https://www.egyptgate.net/robots.txt`](https://www.egyptgate.net/robots.txt).

## Fair use

Please identify yourself with a descriptive `User-Agent`. Responses are CDN cached for
an hour; there is no need to poll faster than that. The catalogue snapshot's build time
is in `https://www.egyptgate.net/api/v1/health`.