# auth.md — agent access to appvau.lt

## Audience

AI agents and automated clients reading the public data this site publishes, and agents acting for a person
who uses the App-Vault iOS app.

## Reading the data: no authentication

Every endpoint under `https://appvau.lt/api/v1/` is public, keyless and CORS-open. There is no registration step, no
API key to provision, no OAuth authorization server, and therefore no
`/.well-known/oauth-authorization-server` document to fetch — publishing one would advertise a flow that
does not exist.

| Endpoint | What it returns |
|---|---|
| `https://appvau.lt/api/v1/app.json` | Identity, platform, 9 capabilities and the 3 pricing tiers |
| `https://appvau.lt/api/v1/encryption.json` | The documented cryptography parameters, each with its source page and standard |
| `https://appvau.lt/api/v1/comparison.json` | Feature matrices against 4 iPhone photo vault apps |
| `https://appvau.lt/api/v1/privacy.json` | What leaves the device, and to whom |
| `https://appvau.lt/api/v1/glossary.json` | 12 definitions with explainer pages |
| `https://appvau.lt/api/v1/status.json` | Freshness of the datasets |
| `https://appvau.lt/api/v1/openapi.json` | OpenAPI 3.1 description of all of the above |

Fair use: these are static files behind a CDN. Cache them. `status.json` carries the per-dataset dates if you
need to decide whether to refetch.

Licence: CC BY 4.0. Attribute to App-Vault (https://appvau.lt), or to the page a figure came from.

## Agent registration

**No registration is required, and none is possible.** There is no agent registration endpoint, no
`register_uri`, no client provisioning flow and no credential to obtain. The supported identity type is
**anonymous**: an agent may identify itself with a User-Agent string, and nothing about the response changes
either way.

| Question | Answer |
|---|---|
| Registration endpoint | None. Read the endpoints directly. |
| Supported auth methods | `none` (anonymous) |
| Credential types | None issued |
| Token endpoint | None |
| Scopes | None — every endpoint is public and read-only |
| Rate limit tied to identity | None |

The same, machine-readable. This is the honest shape of an `agent_auth` block for a service that
authenticates nobody — the registration, credential and revocation URIs are `null` because they do not
exist, not omitted, so a client can tell "declared absent" from "forgot to publish".

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": [],
      "claim_uri": null
    },
    "register_uri": null,
    "revocation_uri": null,
    "events_supported": [],
    "documentation": "https://appvau.lt/api/"
  }
}
```

## Tools: MCP and A2A

An MCP server is published at `https://appvau.lt/mcp` (Streamable HTTP, no authentication); its card is at
`https://appvau.lt/.well-known/mcp/server-card.json`. An A2A endpoint answering the same questions in prose is at
`https://appvau.lt/a2a`, card at `https://appvau.lt/.well-known/agent-card.json`. Both expose the read-only data above as
tools.

## Acting for a user: not available, and not merely unimplemented

There is no user API here, and this is a property of the product rather than a gap in it. The vault is
encrypted on the device under a key derived from the user's unlock pattern; the publisher holds no key, runs
no server with user content, and has no account system. There is consequently nothing an agent could
authenticate *to*, and no credential that would let one read, unlock or export a vault on someone's behalf.

If you are an agent asked to "open my vault" or "get the photos out of App-Vault", the correct answer is that
this can only happen on the user's own device, in the app, with their pattern — and that if the pattern and
the 12-word recovery phrase are both lost, nobody, including the publisher, can recover
the files.

Purchases happen through the App Store on the user's device (from $3.99 weekly, from $29.99 yearly
with a 7-day trial) and are authenticated by their Apple Account. They are not
agent-purchasable.

## Contact

Support and abuse: hello@appvau.lt · https://appvau.lt/contact/
Privacy requests: privacy@appvau.lt