# auth.md - AI Rate Card: access for AI agents

AI Rate Card (https://airatecard.com) is a read-only catalog of AI model API prices across providers.

## No sign-in needed to read

- Every page, `/llms.txt`, `/llms-full.txt` and `/sitemap.xml` are open to every agent and crawler.
- Any page in Markdown: send `Accept: text/markdown`.
- The JSON API `https://airatecard.com/v1` (description: `https://airatecard.com/openapi.json`) and the MCP server `https://airatecard.com/mcp` (Streamable HTTP, read-only) answer without a key, with the limits below.
- API catalog (RFC 9727): `https://airatecard.com/.well-known/api-catalog`.

## Agent registration (OAuth 2.0) - the agent gets its own token with the user's consent

The site runs an OAuth 2.0 authorization server (issuer `https://airatecard.com/`). Discovery: `https://airatecard.com/.well-known/oauth-authorization-server`; protected resources: `https://airatecard.com/.well-known/oauth-protected-resource/mcp/account` and `.../v1`.

1. Register your client: `POST https://airatecard.com/oauth2/register` (RFC 7591 dynamic client registration), JSON with `client_name`, `grant_types` and, for a browser sign-in, `redirect_uris`; a public client uses `"token_endpoint_auth_method": "none"`. Scopes: `api offline_access`, plus `provider` to act for the user's providers (below).
2. Get the user's consent, either way:
   - **Device flow** (RFC 8628) - for scripts and terminal agents: `POST https://airatecard.com/oauth2/device/auth` with `client_id` and `scope`; show the user `verification_uri` and `user_code`; the user signs in on the site, types the code and presses Allow; poll `POST https://airatecard.com/oauth2/token` with `grant_type=urn:ietf:params:oauth:grant-type:device_code`.
   - **Authorization code + PKCE (S256)** - for MCP connectors and apps with a browser: `https://airatecard.com/oauth2/auth`, then `https://airatecard.com/oauth2/token`.
3. Call `/v1` or the MCP server `https://airatecard.com/mcp/account` with `Authorization: Bearer <access_token>`; refresh with `grant_type=refresh_token`. The token carries the user's limits. `/mcp/account` answers 401 with `WWW-Authenticate: Bearer resource_metadata=...` until you send one - MCP clients start sign-in from there.

The user signs in with their own login and password on the site (never through the agent) and can revoke the access at any time in the account.

## A personal key - made by the user by hand

Instead of OAuth a user can make a key and give it to you:

1. Sign up at https://airatecard.com/en/account/registration - a login and a password, no e-mail.
2. Open https://airatecard.com/en/account, section "API keys", and create a key.
3. Send it on every request as `Authorization: Bearer <key>` or `X-API-Key: <key>` - on `/v1`, `/mcp` and `/mcp/account` alike (clients that only take a token, like the Anthropic and OpenAI MCP connectors, use Bearer).

Ready code for Claude, OpenAI, LangChain, the MCP SDKs and plain HTTP: https://airatecard.com/en/docs#agents

A key can be revoked by its owner in the same section at any time. Never put a key or a token in a URL.

## Acting for a provider (listing a company, its files, its offers)

An agent never creates the account: ask your human to sign up at https://airatecard.com/en/account/registration (a login and a password, no e-mail; the first screen offers an authenticator and recovery codes) and then to connect you - OAuth with the scope `provider`, or a personal key from the account.

An agent working for an AI provider walks the provider's whole path through `https://airatecard.com/v1/provider/*` and the `provider_*` tools of `https://airatecard.com/mcp/account`: check the domain and validate models.yaml (public), start the listing, verify the domain, check the files, publish, read the offers, ask for a recheck. It signs those calls with the person's personal key or an OAuth token that carries the scope `provider` (ask for `api provider offline_access`; the consent page tells the person what the agent may do; a token without the scope gets 403 insufficient_scope). Prices never go through the API: the provider publishes them on its own site. Guide with a full example: https://airatecard.com/en/docs#providers-agents.

Need higher limits than the ones below for a product? Write to hello@airatecard.com.

## Limits

| Level | /v1 API | MCP | Download (/export) | Price history |
|---|---|---|---|---|
| Without a key | 60 requests/min, no daily cap, up to offset+limit 100000 | 60 requests/min, no daily cap | 100000 rows a file, 20 files an hour | up to 90 days, one model a request |
| Free personal key | 120 requests/min, no daily cap, up to offset+limit 100000 | 120 requests/min, no daily cap | 100000 rows a file, 60 files an hour | up to 90 days, one model a request |

Every API and MCP answer carries `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and `X-Daily-Rows-Remaining`; over a limit the answer is HTTP 429 with `Retry-After` - wait, do not rotate keys or addresses (the data license forbids getting around the limits).

## Citing

Every API and MCP answer has a `cite` line: name AI Rate Card, link the card or model page used and give the date its price was checked. Documentation: https://airatecard.com/en/docs#api, https://airatecard.com/en/docs#mcp; license: https://airatecard.com/en/data-license.