# Auth.md

Public pages, Markdown, research data and agent tools are free to read without registration, cookies or API keys.

- [Public API catalog](https://floatout.xyz/.well-known/api-catalog)
- [OpenAPI specification](https://floatout.xyz/openapi.json)
- [MCP server card](https://floatout.xyz/api/mcp/server-card)
- [Agent skills](https://floatout.xyz/.well-known/agent-skills/index.json)

## Public agent tools

Connect an MCP client using Streamable HTTP at https://floatout.xyz/api/mcp. The server is stateless and supports JSON responses. POST with `Content-Type: application/json` and `Accept: application/json, text/event-stream`. Initialize, then call `tools/list` to see current inputs.

`read_floatout_page` reads one of the listed public pages. `read_builder_fee_study` reads a fixed historical research sample. Both are read-only. Supporting browsers also expose these tools through WebMCP on marketing pages.

Request public pages with `Accept: text/markdown` for Markdown or `Accept: text/html` for the website.

## Agent registration

Public agent tools require no registration. Delegated user registration is not supported. Floatout does not issue OAuth tokens or agent identity assertions. Creating an owner account requires the user to connect and sign with their wallet in the console.

## Owner console

Owners sign in at https://app.floatout.xyz using Sign-In with Ethereum (SIWE). There is no password registration or OAuth authorization server.

The console requests a nonce and exact message from `POST /api/auth/nonce` with `{ "address": "0x..." }`. The owner reviews and signs that message in their wallet. `POST /api/auth/verify` with `{ "nonce": "...", "signature": "0x..." }` verifies it and sets an HttpOnly, host-only session cookie. Nonces expire after ten minutes and are single-use. Sessions last seven days. `POST /api/auth/logout` clears the session.

Use the console UI for account creation, publishing and transactions. Public agent tools cannot access accounts, sign messages, change platforms, place trades or move funds. Never supply a private key or seed phrase to an agent or Floatout.