# auth.md — Authentication for agents (ahmedmoheb.com)

## Public content: no authentication

- Public pages, their `.md` alternates, `/llms.txt`, `/llms-full.txt`,
  `/apis.json`, `/openapi.json`, the agent skill at `/skills`, and the
  public prayer APIs (`/api/prayers/*`) and `/api/markdown` require no
  authentication. Use them freely and cache respectfully.
- There is no OAuth server, no API-key program, and no agent credential
  issuance on this site. Do not look for one.

## Consultation enquiries: human-gated

- The consultation form at `/contact` is protected by reCAPTCHA and is
  intended for humans. Agents should present the form (or the contact
  details below) to the user and let the user submit it — never auto-submit.
- Direct contact: hello@ahmedmoheb.com · +201000431994 · Damietta, Egypt.

## Admin: human-only, no agent access

- `/admin` is protected by password login plus Telegram OTP second factor.
  It is for the site owner only. Agents must not attempt to log in, brute
  force, or use any credential found anywhere to access it.
- The content-ingest API (`/api/content/ingest`) requires a bearer token
  that is never published; it is not part of the public API surface.

## Bots and crawlers

- AI crawlers are welcome: see `/robots.txt` for the explicit allow-list
  (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended,
  Meta-ExternalAgent, and others). Only `/admin` and the non-public APIs
  above are disallowed.