# auth.md for Folia

Folia (https://www.folia.farm) is a **publicly readable** site-suitability tool. There
are no agent-callable APIs behind authentication today, so an agent does not
need to register, obtain credentials, or exchange tokens to use Folia. This
file exists so a scanner can confirm that stance rather than assume Folia
gates its content and give up.

## Agent audience

- AI answer engines and live-fetch assistants that cite site-suitability
  information for a specific US property (ChatGPT-User, ClaudeBot,
  Claude-User, OAI-SearchBot, PerplexityBot, Perplexity-User, and the like).
- Automated pipelines that index our public catalogue for search or product
  discovery.
- Search-engine crawlers (Googlebot, Bingbot).

Agents whose primary purpose is training a foundation model on Folia's
content (GPTBot, CCBot, Bytespider, Amazonbot, meta-externalagent) are asked
to honor Folia's content signals: see `/robots.txt` for the machine-readable
declaration, which sets `ai-train=no`.

## Registration or provisioning

- **Not required.** Send `GET` requests. There is no client-registration
  endpoint, no client ID, no client secret, and no bearer token to obtain.
- Please identify yourself with a truthful `User-Agent` string that names
  your operator and, where applicable, includes contact information (the
  convention used by GPTBot, ClaudeBot, and PerplexityBot).

## Supported methods

- **No auth.** Requests without credentials are served the same content as
  any browser.
- **Content negotiation.** Send `Accept: text/markdown` to receive a hand-
  authored markdown variant of the marketing pages (`/`, `/library`,
  `/about`, `/contact`, `/privacy`, `/terms`, `/methodology`, `/faq`) or a
  markdown 404 recovery body on any other path. See `/llms.txt` for the
  full agent-facing guidance.

## Machine-readable resources

- **Agent guidance and when-to-use rules:** `https://www.folia.farm/llms.txt`
- **Sitemap:** `https://www.folia.farm/sitemap.xml`
- **Crawler rules and content signals:** `https://www.folia.farm/robots.txt`
- **API catalog (RFC 9727):** `https://www.folia.farm/.well-known/api-catalog`
- **Security disclosure (RFC 9116):** `https://www.folia.farm/.well-known/security.txt`

## Credential use

- No credentials are issued or accepted by Folia. If your client sends an
  `Authorization` header, it is ignored. Rate limiting, when it applies, is
  by IP and by `User-Agent`.

## Contact

- **General:** support@folia.farm
- **Security:** support@folia.farm with "security" in the subject line, or
  the machine-readable channel at `https://www.folia.farm/.well-known/security.txt`.