# Authentication — dribba.com

> **There is nothing to authenticate.** Every read surface on dribba.com is
> public and anonymous: no API keys, no OAuth, no bearer tokens, no accounts, no
> registration. This document exists so an agent does not assume a closed door
> and give up.

Last-Updated: 2026-08-21
Canonical: [https://dribba.com/auth.md](https://dribba.com/auth.md)
API reference: [https://dribba.com/docs](https://dribba.com/docs)
Protected-resource metadata: [https://dribba.com/.well-known/oauth-protected-resource](https://dribba.com/.well-known/oauth-protected-resource)

## Discover

| What | Where |
|---|---|
| This document | https://dribba.com/auth.md |
| Protected-resource metadata (RFC 9728) | https://dribba.com/.well-known/oauth-protected-resource |
| API contract (OpenAPI 3.1) | https://dribba.com/openapi.json |
| API index, versions, quota | https://dribba.com/api |
| MCP server card | https://dribba.com/mcp/server-card |
| Domain AI catalog | https://dribba.com/.well-known/ai-catalog.json |

The protected-resource metadata declares `authorization_servers: []` — an
empty list, on purpose. It is not an omission: it is the statement that this
resource accepts unauthenticated requests.

## Pick a method

There is one method, and it is **anonymous**.

```
identity_types_supported: ["anonymous"]
anonymous.credential_types_supported: ["none"]
```

The `identity_assertion` flow — an agent presenting an ID-JAG
(`urn:ietf:params:oauth:token-type:id-jag`) assertion from its own identity
provider so the app can vouch for a user — **does not apply here**. It exists to
create or link a *user account*, and dribba.com has no user accounts to link. If
that ever changes, this file changes with it and the `agent_auth` block will
appear in the metadata above.

```bash
# The whole method, start to finish
curl [https://dribba.com/api/v1/services](https://dribba.com/api/v1/services)
```

## Register

**No registration.** There is no `register_uri`, because there is no account,
tenant, or client to create and no credential to hand back. An agent that would
normally POST to a registration endpoint should skip straight to calling the API.

We do not advertise a `register_uri` that returns a polite "not needed": a URI
in a discovery block is a promise that a real registration happens there.

## Claim

**Nothing to claim.** The user-claimed flow (agent shows the user a code, the
user signs in and confirms it) needs an account to attach the claim to. There is
none. No `claim_uri`.

## Use the credential

There is no credential. Call the API directly:

```bash
curl [https://dribba.com/api/v1/company](https://dribba.com/api/v1/company)
curl -H 'Accept: text/markdown' [https://dribba.com/servicios](https://dribba.com/servicios)
curl [https://dribba.com/index.md](https://dribba.com/index.md)
```

Rate limits stand in for credentials: **120 requests per 60 seconds per client
IP**, advertised on every response through the IETF `RateLimit-Policy` and
`RateLimit` structured fields, with `Retry-After` on a 429. Honour them and
you will not be blocked. Details: [https://dribba.com/docs#limites](https://dribba.com/docs#limites)

### Writes

The site's own form endpoints (`/api/contact`, `/api/apply`,
`/api/resources`, `/api/estimate`) do write, and they require a same-origin
request from dribba.com. From anywhere else they answer `403` with
`code: "origin_not_allowed"`.

The supported path for an agent that wants to reach a human is the MCP tool
`submit_contact_request` on https://dribba.com/mcp, which asks the user to
confirm before anything is sent. That confirmation is the authorization.

## Errors

Every 4xx and 5xx is RFC 9457 problem details (`application/problem+json`) with
a stable `code`. The auth-shaped ones:

| Code | Status | Meaning |
|---|---|---|
| `origin_not_allowed` | 403 | A write endpoint was called from another origin. Use the MCP tool. |
| `rate_limit_exceeded` | 429 | Quota spent. Honour `Retry-After`. |

**There is no `401` and no `WWW-Authenticate` challenge anywhere on this
domain.** A scanner looking for `WWW-Authenticate: Bearer resource_metadata=…`
will not find one, and that is correct: `/api/v1` answers `200` without
credentials, so advertising a challenge would break any client that obeyed it.
The protected-resource metadata carries the same information without lying about
a 401 that never comes.

## Revocation

Nothing is issued, so nothing can be revoked. No `revocation_uri`.

If you need to stop calling us, stop calling us. If we need to stop you, it is a
rate limit or an IP block, and there is no token to invalidate.

## Verifying us, rather than you

The asymmetric case — you want to check that the thing answering is really
Dribba:

- [`did:web:dribba.com`](https://dribba.com/.well-known/did.json)
- [Web Bot Auth key directory (Ed25519, RFC 9421)](https://dribba.com/.well-known/http-message-signatures-directory)
- [Trust manifest per catalog entry](https://dribba.com/.well-known/ai-catalog.json)
- [WebFinger](https://dribba.com/.well-known/webfinger?resource=https://dribba.com)

Questions: hola@dribba.com