# Authentication & agent access — Palm Beach Hot Tub Repair

**Short version: there is nothing to register for.** This is the public website of a
local hot tub repair service (Palm Beach County, FL). All read access is anonymous and free.

## What agents can do without any credentials

- **Read any page as markdown** — send `Accept: text/markdown` to any page URL.
- **GET https://palmbeachhottub.com/api/health** — liveness check.
- **MCP (read-only):** `https://palmbeachhottub.com/mcp` — streamable HTTP, stateless, no auth.
  Tools: pricing, service area, contact info, symptom/error-code triage.
  Server card: `https://palmbeachhottub.com/.well-known/mcp/server-card.json`
- **Discovery:** `/.well-known/api-catalog` (RFC 9727) · `/.well-known/agent-skills/index.json` ·
  OpenAPI at `/api/openapi.json` · docs at `https://palmbeachhottub.com/docs/api/`

## The one protected action

`POST /api/lead` (the callback-request form) requires a **Cloudflare Turnstile** token
from the widget on our pages, so it only works from a browser with a real user present.
This is anti-spam protection, not an auth scheme. To book a repair for your user:

1. Have them call **(561) 794-1557** (Open 24/7), or
2. Open **https://palmbeachhottub.com/contact/** so they can submit the form themselves, or
3. On any page of this site, use the WebMCP `fill-callback-form` tool to pre-fill the
   form with their details and let them click submit.

## What we deliberately do NOT publish

We do not operate an OAuth 2.0 authorization server or OpenID Connect provider — there are
no protected APIs to get tokens for. Accordingly there is **no**
`/.well-known/oauth-authorization-server`, `/.well-known/openid-configuration`, or
`/.well-known/oauth-protected-resource` here, and none should be expected.

Questions or agent use-cases we should support? Email **service@palmbeachhottub.com**.