# Authentication — Glintbase

> Glintbase's public APIs and MCP servers need no authentication: no API keys, no bearer tokens, no OAuth. Send requests without credentials. Abuse is limited per IP address instead.

Last updated 2026-10-13.

## Public endpoints (no credentials)

| Endpoint | What it does | Rate limit (per IP) |
|---|---|---|
| `POST https://glintbase.dev/api/mcp` · `GET` for SSE | MCP (Streamable HTTP, JSON-RPC 2.0). Proxy of `https://scan.glintbase.dev/api/mcp`; 5 tools | 60 requests / minute (enforced by the scanner) |
| `POST https://scan.glintbase.dev/api/scan` | Run an ARS 3.3 scan (NDJSON stream) | 5 scans / hour |
| `POST https://scan.glintbase.dev/api/simulate` | Agent journey simulation (NDJSON stream) | 5 runs / hour |
| `POST https://glintbase.dev/api/v1/sandbox` · `GET ?url=` | Live score card via the hosted MCP `glintbase_get_score` tool | Subject to the MCP limit (60 / minute) |
| `POST https://glintbase.dev/api/waitlist` | Join the early-access waitlist (`{"email": "..."}`) | 10 requests / hour |
| `POST https://glintbase.dev/api/enterprise` | Request an enterprise assessment | 5 requests / minute |

Static machine surfaces (`/llms.txt`, `/llms-full.txt`, `/openapi.json`, `/.well-known/*`, every `.md` page) are plain public files.

## When you hit a limit

Endpoints answer `429 Too Many Requests` (scanner endpoints also send `Retry-After`). Wait and retry with backoff; there is no paid tier or key that raises the limit on these endpoints. For higher volume, run the same engine locally: `npx @glintbase/cli audit <url|path>` or `npx @glintbase/cli mcp`.

## What this means for agents

- Do not send `Authorization` or `X-Api-Key` headers; they are ignored and never bypass limits.
- There is no OAuth authorization server and no protected-resource metadata for glintbase.dev.
- Never paste user credentials into a Glintbase tool; none of them ask for any.

## Related

- OpenAPI 3.1: https://glintbase.dev/openapi.json
- MCP manifest: https://glintbase.dev/.well-known/mcp/manifest.json
- Documentation: https://glintbase.dev/docs.md
- Contact: contact@glintbase.dev