# Agent authentication — dcmcapital.fi

**Short version: no authentication is required. Everything an agent can reach on
this site is public and read-only.**

This document exists so that agents do not waste requests probing for an OAuth
flow that is not there.

## Authentication status

| | |
|---|---|
| Registration required | No |
| Credentials issued | None |
| OAuth / OIDC authorization server | Not operated |
| Protected resources | None |
| Rate limit | No hard limit; be reasonable (see below) |

There is deliberately no `/.well-known/oauth-authorization-server` and no
`/.well-known/oauth-protected-resource` on this origin. Their absence is
accurate, not an oversight: no endpoint here requires a token, so publishing
authorization-server metadata would describe a service that does not exist.

## What is available without authentication

| Resource | URL |
|---|---|
| API catalog | `/.well-known/api-catalog` |
| Agent skills index | `/.well-known/agent-skills/index.json` |
| Site summary for LLMs | `/llms.txt` |
| Sitemap index | `/sitemap_index.xml` |
| Podcast episode sitemap | `/podcast-episodes.xml` |
| Podcast episodes API | `/wp-json/dcm/v1/episodes` |
| WordPress REST API (read-only) | `/wp-json/wp/v2/` |
| Podcast RSS feed | `/podcast/feed/` |

Any page will return markdown instead of HTML if you send
`Accept: text/markdown` and a markdown rendition exists for it.

## Conditions of use

Content usage preferences are declared in `/robots.txt` using Content-Signal:

```
Content-Signal: search=yes, ai-input=yes, ai-train=yes
```

You may index this site, read it to answer a user's question, and use it for
model training or fine-tuning. Attribution and canonical DCM Capital URLs are
requested wherever the product or output supports source citations.

## Being a good citizen

The origin is a single WordPress host, not a CDN-backed API. Please:

- keep concurrency to about 4 simultaneous requests,
- prefer `/podcast-episodes.xml` and `/wp-json/dcm/v1/episodes` over
  crawling HTML pages,
- send a `User-Agent` that identifies you and gives a contact URL,
- honour `Cache-Control` on the responses you get.

If you operate a bot that signs its requests, this site publishes a Web Bot Auth
key directory at `/.well-known/http-message-signatures-directory`. Signing is
welcome but not required.

## Contact

Technical or access questions: `sami.miettinen@dcmcapital.fi`
Operator: DCM Capital Oy, Kalevankatu 54 C 27, 00180 Helsinki, Finland