# auth.md — example.com

## Overview

Protected API endpoints use a static API key. No OAuth or OIDC flows are supported.

## API Key Authentication

Pass the key as a Bearer token header. Query-string API keys are not supported.

```
Authorization: Bearer <SRP_API_KEY>
```

## Protected Endpoints

| Endpoint | Method | Description |
|---|---|---|
| `https://r.example.com/api/shorten.php` | POST | Shorten a URL or generate a short token |

## Short Link API

**JSON body with Bearer header:**
```http
POST https://r.example.com/api/shorten.php
Authorization: Bearer <SRP_API_KEY>
Content-Type: application/json

{"sub_id": "TRACKER123"}
```

**Response:**
```json
{
  "ok": true,
  "code": "abc12",
  "token": "s-abc12",
  "url": "https://r.example.com/s-abc12"
}
```

## Obtaining a Key

Contact the site administrator to request an API key.

## Public Endpoints

| Endpoint | Description |
|---|---|
| `https://example.com/health.php` | Health check (db, geoip2, extensions) |
| `https://example.com/.well-known/api-catalog` | API catalog (RFC 9727, linkset+json) |
| `https://example.com/.well-known/agent-skills/index.json` | Agent skills index |
| `https://example.com/.well-known/mcp/server-card.json` | MCP server card |
