# Authentication

## Discover

The public surface is the scan API described at https://buildmydigital.co.uk/openapi.json (paths under /api/v1/) and the MCP servers at https://buildmydigital.co.uk/mcp/ and https://buildmydigital.co.uk/mcp/docs/. None of them requires a credential.

## Pick a method

There is one method for agents: no authentication. Send the request. Every response carries `RateLimit` and `RateLimit-Policy` headers (5 scans per address every 10 minutes, 300 a day across everyone); a 429 carries `Retry-After` and an RFC 9457 problem body.

## Register, claim, exchange

Not needed. There is no registration endpoint, no API key, no OAuth server, no token exchange. Do not send an `Authorization` header: a bearer token on the scan API is reserved for Build My Digital's own operations console and any other token is refused with 401.

## Use

    curl "https://buildmydigital.co.uk/api/v1/scan/?url=yourbusiness.co.uk"

`url=sandbox` returns a fixed sample report without counting against the allowance, for testing clients.

## Errors and revocation

Errors are `application/problem+json` with `type`, `title`, `status`, `detail` and a plain `error` line. There is nothing to revoke. If the free allowance is not enough for a real project, email hello@buildmydigital.co.uk and we will open a lane.