# auth.md

Church Near Me is a **public read-only resource**. Discovering, reading and querying the directory needs no account.

## Lifecycle

1. **Discover** — fetch `/.well-known/api-catalog`, `/llms.txt` or `/.well-known/mcp/server-card.json`.
2. **Register** — not required. `register_uri` is null. `identity_types_supported` is `["anonymous"]`.
3. **Claim** — not required. There is no client identity to claim.
4. **Exchange** — not required. No tokens are issued.
5. **Use** — call `GET /api/churches`, `GET /api/churches/{slug}`, or `POST /mcp` (JSON-RPC 2.0). CORS is open on machine surfaces.
6. **Revoke** — not applicable. There is nothing to revoke.

Higher-limit authenticated access does not exist today. If that changes, this file will describe a real authorization server — we will not publish an OAuth discovery document that leads nowhere.

## Church-team administration

The separate /church-team area is invite-only. It uses one-time codes, revocable sessions, role checks and CSRF protection. Its private endpoints are not part of this public read-only API. Do not send church-team codes or cookies to machine discovery endpoints.

Contact: hello@churchnearme.org.uk
Policy: https://churchnearme.org.uk/editorial-policy