# Authentication — Conference Partner (myhuiban.com)

How agents and API clients authenticate against our data endpoints
(REST API under `/api/*` and the MCP server at `POST /mcp`).

Human-readable guide with copy-pasteable examples:
<https://www.myhuiban.com/developers>

## What needs no credentials

Most of the data surface is open — call it directly, no account, no token:

- **REST**: `GET /api/conferences`, `GET /api/conferences/rankings/{ranking}`,
  `GET /api/journals`, `GET /api/journals/rankings/{ranking}`, `GET /api/statistics`
- **MCP**: `initialize`, `tools/list`, `ping`, plus these `tools/call` tools:
  `search_conferences`, `search_journals`, `list_conferences`, `list_journals`,
  `get_statistics`
- All public HTML pages, `llms.txt`, `llms-full.txt`, `sitemap.xml`, RSS/iCal feeds
- The OpenAPI schema: `GET /api/openapi.json`
- The API catalog: `GET /.well-known/api-catalog`

Anonymous calls are counted per source IP against a small daily quota (default 50).
Responses carry `X-Quota-Limit` / `X-Quota-Remaining`. Exceeding it returns HTTP `429`
— register a free account for a much larger quota.

CORS is open on both surfaces (`Access-Control-Allow-Origin: *`; credentials travel in
the `Authorization` header, never in cookies), so browser-based clients work too.

## What needs an account

Only the per-venue **detail** endpoints:

- **REST**: `GET /api/conferences/{id}`, `GET /api/journals/{id}`,
  `GET /api/researchers/{id}`
- **MCP**: `get_conference`, `get_journal`, `get_researcher`

They return CFP full text, acceptance-rate history, edition history, special issues,
ratings and comments; the researcher endpoint returns a public profile (never any
contact details, and there is no researcher search or enumeration — by id only).
Without credentials they return HTTP `401`.

### Free account JWT

1. Register a free account at <https://www.myhuiban.com/registration>
   (email verification required).
2. Exchange credentials for a token:

   ```
   POST https://www.myhuiban.com/api/login
   Content-Type: application/json

   {"email": "you@example.com", "password": "..."}
   ```

3. Send the token on every data request:

   ```
   Authorization: Bearer <token>
   ```

Tokens are long-lived JWTs (~6 months). Free accounts share a **daily quota**
(default 200) across the REST API and MCP `tools/call` (see the `X-Quota-Limit` /
`X-Quota-Remaining` response headers). Exhausting it returns HTTP `402`.

Need a higher limit or a bulk export? Email admin@myhuiban.com with your use case.

## Not supported (yet)

- **Per-request x402 payment**: planned, not live. The origin recognises an
  `X-Paid-Access` header injected by the edge after payment verification, but the
  edge-side payment gateway is not enabled, so a client currently has no way to pay
  per request. Use the free anonymous tier or a free-account JWT instead.
- **OAuth 2.0 / OpenID Connect**: we do not operate an authorization server, so there
  is no `/.well-known/openid-configuration`, `/.well-known/oauth-authorization-server`
  or `/.well-known/oauth-protected-resource`. Do not attempt OAuth flows — MCP clients
  that only support OAuth can still use every tool that needs no credentials.
- **Programmatic (agent) self-registration**: account signup is via the web form.

## Contact

admin@myhuiban.com — see also <https://www.myhuiban.com/developers> (developer guide),
`/llms.txt` (site description for LLMs) and
`/.well-known/mcp/server-card.json` (MCP server card).