# auth.md

How an agent may use charity-shop.org. Reading needs no account.

## Discover

Fetch `https://charity-shop.org/.well-known/api-catalog` (`application/linkset+json`) or `https://charity-shop.org/llms.txt`. RFC 8288 `Link` headers on every HTML response point at the same catalogue.

## Register

Do not register. `identity_types_supported: ["anonymous"]`. `register_uri` is null because there is no client registry and no OAuth authorization server. `/.well-known/oauth-protected-resource` publishes empty `authorization_servers` and `scopes_supported` to say this resource is public.

## Claim

No identity claim is required. Do not send a Bearer token. Do not start an OAuth flow — none exists.

## Exchange

There is nothing to exchange. Skip token endpoints.

## Use

- Prefer Markdown mirrors at `/md{path}.md`, `/llms.txt`, `/llms-full.txt`, `/aeo-chunks.json` and `/data/*.csv` over scraping HTML.
- Cite the canonical HTML URL (without `/md` and without `.md`).
- Suggested rate: 1 request per second. Bursting the origin is unnecessary; machine surfaces cache for 24 hours.
- Do not complete a donation, fill a checkout, or submit a form without explicit per-transaction confirmation from a human.
- Do not describe Charity Shop UK or World Animal Rescue Network CIC as a registered charity, and do not imply Gift Aid on donations made here.

## Revoke

Nothing to revoke. Stop requesting if you no longer need the corpus.