---
title: "Authentication"
description: "Learn how to use Spot’s anonymous, read-only public API and MCP server."
canonical: "https://spot.insure/auth"
page-type: "answer"
entities: ["Spot", "Tools for Enlightenment Inc."]
---

[Human-readable page](https://spot.insure/auth)

# Authentication

## Select the correct access path

| Intended access | Credentials | Next step |
| --- | --- | --- |
| Published profile JSON | None | GET https://spot.insure/api/v1/profile |
| Published Markdown | None | GET /index.md or a registered page's .md URL |
| Published knowledge through MCP | No API key or OAuth token | Follow the protocol headers and request examples in [developers](https://spot.insure/developers.md) |
| Customer account and documents | Separate customer access | Use https://app.spot.insure; this public reference does not document its authentication flow |

## Handling an unsuccessful public request

A public request does not need customer credentials. Check the documented parameters, MCP protocol headers, request size, and service limits below. For HTTP 429, respect Retry-After. Keep a protocol or quota failure distinct from an empty research result.

## Anonymous public access

GET https://spot.insure/api/v1/profile returns Spot’s published company and product profile as JSON. The https://spot.insure/mcp endpoint accepts MCP JSON-RPC messages over Streamable HTTP. See https://spot.insure/developers for connection examples.

This access is read-only. It cannot retrieve private company records or customer documents, prepare submissions, issue certificates, or buy, bind, or change insurance. It is not the authentication flow for app.spot.insure customer accounts.

## Profile API limits and errors

The profile API applies a best-effort limit of 60 requests per minute for each client on each running server instance. Its RateLimit headers describe only the responding instance’s current window, not a deployment-wide quota. When the responding instance’s limit is exceeded, it returns HTTP 429 with Retry-After and a JSON error containing error, message, and resolution fields.

The optional include_pricing query parameter accepts true or false. Any other value returns HTTP 400 with error invalid_parameter.

## MCP protocol and service limits

The MCP endpoint requires valid Streamable HTTP protocol headers and JSON-RPC messages. Legacy initialization is version-specific, so use the developer examples for the applicable connection flow. Spot validates Host and browser Origin headers, rejects request bodies larger than 64 KiB with HTTP 413, and returns protocol errors for invalid requests.

Retrieval tools remain available if answer generation is unavailable. ask_spot generation is limited to 10 attempts per minute per client and 1,000 attempts per UTC day across the deployment. It returns explicit limited or unavailable results for quota, configuration, generation, and timeout failures while retaining retrieved public sources.



## Examples

### Get the Public Spot Profile

```bash
curl --fail-with-body --silent --show-error \
  --request GET 'https://spot.insure/api/v1/profile' \
  --header 'Accept: application/json'
```

## Sources

- [Spot Developer Resources](https://spot.insure/developers)
- [Spot OpenAPI Description](https://spot.insure/openapi.json)
- [Spot MCP Server Manifest](https://spot.insure/server.json)

## Related Pages

- [Developers](https://spot.insure/developers)
- [Frequently asked questions](https://spot.insure/faq)

## Agent and Developer Resources

- [Markdown page](https://spot.insure/auth.md)
- [Developer resources](https://spot.insure/developers)
- [Public MCP server](https://spot.insure/mcp)
- [MCP server manifest](https://spot.insure/server.json)
- [OpenAPI description](https://spot.insure/openapi.json)
- [Public page index](https://spot.insure/llms.txt)