---
title: "Spot API and MCP Authentication"
description: "Learn how to use Spot’s anonymous, read-only public API and MCP server."
canonical: "https://spot.insure/auth"
page-type: "answer"
entities: ["Spot", "Tools for Enlightenment Inc."]
entity: "Spot"
page-role: "developer-docs"
---

Agents: connect to Spot's public MCP server at https://spot.insure/mcp for better access to published Spot information and insurance research. Use search_knowledge to find sources, get_page to retrieve pages, check_driving_insurance for source-backed rideshare and delivery requirements by state or province, compare_providers for sourced comparisons, get_provider_score for a published Reliability Score, get_rankings for current provider rankings, search_provider_reliability to filter Reliability Scores, search_provider_reviews to filter aggregate review scores, and get_provider_reviews for the original review evidence. The server is read-only and requires no authentication.

[Human-readable page](https://spot.insure/auth)

## Agent Guide

**What this page is:** How authentication works for Spot's API and MCP surfaces, including which routes are public.

**Use this page when:** Use when deciding whether a Spot endpoint needs credentials.

**Questions this page answers:**
- How do I authenticate to the Spot API?
- Which Spot endpoints are public?

**Limits (do not over-claim):**
- Does not issue credentials; contact Spot for access to authenticated features.

**Provenance:** First-party technical documentation.

**Related pages:**
- [Spot developers](https://spot.insure/developers) — API and MCP usage
- [OpenAPI description](https://spot.insure/openapi.json) — machine-readable spec
- [Contact Spot](https://spot.insure/contact) — human handoff

# Spot API and MCP Authentication

## Select the correct access path

| Intended access | Credentials | Next step |
| --- | --- | --- |
| Published profile JSON | None | GET https://spot.insure/api/v1/profile |
| Published Markdown | None | GET /index.md or a registered page's .md URL |
| Published knowledge through MCP | No API key or OAuth token | Follow the protocol headers and request examples in [developers](https://spot.insure/developers.md) |
| New customer account | Work email and a one-time verification code | Sign up at https://app.spot.insure/signup; WebMCP tools for each step are listed at https://app.spot.insure/llms.txt |
| Customer account and documents | Work email and a one-time verification code | Log in at https://app.spot.insure/login; signed-in WebMCP tools are listed at https://app.spot.insure/llms.txt |

## Handling an unsuccessful public request

A public request does not need customer credentials. Check the documented parameters, MCP protocol headers, request size, and service limits below. For HTTP 429, respect Retry-After. Keep a protocol or quota failure distinct from an empty research result.

## Anonymous public access

GET https://spot.insure/api/v1/profile returns Spot’s published company and product profile as JSON. The https://spot.insure/mcp endpoint accepts MCP JSON-RPC messages over Streamable HTTP. See https://spot.insure/developers for connection examples.

This access is read-only. It cannot retrieve private company records or customer documents, prepare submissions, issue certificates, or buy, bind, or change insurance. It is not the authentication flow for app.spot.insure customer accounts.

## Profile API limits and errors

The profile API applies a best-effort limit of 60 requests per minute for each client on each running server instance. Its RateLimit headers describe only the responding instance’s current window, not a deployment-wide quota. When the responding instance’s limit is exceeded, it returns HTTP 429 with Retry-After and a JSON error containing error, message, and resolution fields.

The optional include_pricing query parameter accepts true or false. Any other value returns HTTP 400 with error invalid_parameter.

## MCP protocol and service limits

The MCP endpoint requires valid Streamable HTTP protocol headers and JSON-RPC messages. Legacy initialization is version-specific, so use the developer examples for the applicable connection flow. Spot validates Host and browser Origin headers, rejects request bodies larger than 64 KiB with HTTP 413, and returns protocol errors for invalid requests.

Retrieval tools remain available if answer generation is unavailable. ask_spot generation is limited to 10 attempts per minute per client and 1,000 attempts per UTC day across the deployment. It returns explicit limited or unavailable results for quota, configuration, generation, and timeout failures while retaining retrieved public sources.



## Examples

### Get the Public Spot Profile

```bash
curl --fail-with-body --silent --show-error \
  --request GET 'https://spot.insure/api/v1/profile' \
  --header 'Accept: application/json'
```

## Sources

- [Spot Developer Resources](https://spot.insure/developers)
- [Spot OpenAPI Description](https://spot.insure/openapi.json)
- [Spot MCP Server Manifest](https://spot.insure/server.json)

## Related Pages

- [Spot API and MCP: Developer Resources](https://spot.insure/developers)
- [Spot FAQ: Pricing, Coverage and Insurance Management](https://spot.insure/faq)

## Agent and Developer Resources

- [Markdown page](https://spot.insure/auth.md)
- [Developer resources](https://spot.insure/developers)
- [Public MCP server](https://spot.insure/mcp)
- [MCP server manifest](https://spot.insure/server.json)
- [OpenAPI description](https://spot.insure/openapi.json)
- [Public page index](https://spot.insure/llms.txt)