# WenToGo auth.md

WenToGo is a public, read-only travel-timing website. There is no
authentication and there is nothing to register for.

- No API keys, tokens, or credentials are required for any page or endpoint.
- There is no registration or provisioning endpoint, because there are no
  protected resources.
- Automated clients should send no `Authorization` header; every documented
  surface answers plain `GET` requests.
- There is no authorization server, so `/.well-known/openid-configuration`
  and `/.well-known/oauth-authorization-server` are absent on purpose. A 404
  on those paths is the honest answer rather than a gap: metadata naming an
  issuer, a token endpoint and a JWKS URI that do not exist would send agents
  somewhere there is nothing to reach.

For resource identification and documentation discovery, WenToGo also publishes
[OAuth Protected Resource Metadata](https://wentogo.com/.well-known/oauth-protected-resource).
That metadata does not replace this no-auth statement.

To learn what to fetch instead, read [llms.txt](https://wentogo.com/llms.txt).