# Auth.md

EFEX access for agents.

## Public information

The official public site is https://efex.pro. Public pages and the public
information endpoints below require no authentication:

- `GET /.well-known/api-catalog`: public API directory (RFC 9727).
- `GET /.well-known/efex-openapi.json`: public API description.
- `GET /api/agent/resources?language=en`: official public page links. Supported
  languages: `en`, `fa`, `ru`.
- `POST /api/agent/mcp`: stateless MCP public information tools.
- `POST /api/agent/a2a`: deterministic A2A public information service.

These services return navigation links and access policy only. They do not
provide personalized advice, quotes, balances, orders or customer information.

## Registration and sign-in

A human can create an account at https://efex.pro/en/sign-up and sign in at
https://efex.pro/en/sign-in. The human must complete any terms acceptance,
verification, identity checks and OTP steps themselves on the official site.

Delegated agent account registration, OAuth authorization and account access
are not supported by these public information services. Do not reuse a human's
session or ask for passwords, OTPs, API keys, identity documents or wallet keys.
Never submit credentials or personal information to the public agent endpoints.

Trading, payments, deposits, withdrawals and transfers require a human. The
public information tools have no financial execution capability.

## MCP

Discover the server at `/.well-known/mcp/server-card.json`. Send JSON-RPC 2.0
requests to `/api/agent/mcp` with `Content-Type: application/json` and
`Accept: application/json, text/event-stream`. Initialize with protocol version
`2025-06-18`, then call `tools/list` or `tools/call`. No session identifier or
credentials are required. Requests after initialization may send
`MCP-Protocol-Version: 2025-06-18`.

- `get_public_resources`: optional `language` (`en`, `fa`, `ru`; defaults to `en`).
- `get_access_policy`: no arguments.

The server returns JSON responses, has no SSE stream and stores no sessions.
Both tools are read-only and make no upstream requests.

## A2A

Discover the service at `/.well-known/agent-card.json`. It supports A2A 0.3.0
JSON-RPC `message/send` at `/api/agent/a2a`. Provide a user message with a
`messageId` and text parts. Optional `message.metadata.language` selects `en`,
`fa` or `ru`. The synchronous result is an agent Message with a data part
containing the directory and access policy. This is a deterministic directory,
not a conversational support bot. It does not create tasks, stream responses,
accept file attachments, or send push notifications.

## Content use and operational limits

Public content allows search indexing, AI input and AI training as declared in
`robots.txt`. Honor all path exclusions and applicable site terms. Permission
to use public content grants no access to protected pages or accounts.

JSON-RPC request bodies are limited to 8 KiB. Cross-origin browser submissions
are rejected. Existing site security and rate limits continue to apply. Do not
send sensitive data; the application does not log or persist request bodies,
but infrastructure may retain its normal request telemetry.