# auth.md — AntalyaTransfers agent access

This document tells AI agents how they may interact with AntalyaTransfers.co (private airport transfers, Antalya Airport AYT). It is the source of truth for agent access; it is intentionally self-contained because no OAuth authorization server is published for agents.

## Audience

- Intended audience: AI assistants acting for a human traveller who wants to price, request, or check a transfer.
- Not intended for: automated account creation, scraping of vendor or admin areas, or bulk booking.

## Agent registration

No registration is needed and none exists. AntalyaTransfers issues **no** API keys, client credentials, or tokens to agents; the MCP server and the public endpoints below are anonymous. Do not attempt to register an agent or provision credentials, and do not look for an OAuth flow: access is open, and abuse is controlled by rate limits and operator review of every request.

## Supported access methods

1. **MCP server (anonymous, recommended for assistants).** `https://api.antalyatransfers.co/api/mcp` speaks MCP over Streamable HTTP. Tools: `get_price_quote`, `create_transfer_request`, `get_request_status`. Every request is pending until the operator confirms it (by WhatsApp or email) and confirms the final price. Submitting a request does not take payment and is not a confirmed booking. Setup instructions for ChatGPT and Claude: https://antalyatransfers.co/en/mcp.

2. **Public, unauthenticated reads (no credentials).** Base URL: `https://api.antalyatransfers.co`.
   - `GET /api/status` — service health.
   - `GET /api/locations/popular` and `GET /api/locations/search` — pickup and drop-off locations.
   - `GET /api/fx/rates` — currency rates.
   - `GET /api/referral/validate/{code}` — validate a referral code.
   - Public API description: `https://antalyatransfers.co/openapi.json`. Discovery index: `https://antalyatransfers.co/.well-known/api-catalog`.

3. **Price estimate (no credentials).** `POST /api/pricing/estimate` returns an indicative price for a route, vehicle type, and time. Prices are estimates; the human customer confirms the final price at booking.

4. **Guest booking (no account, no credentials).** `POST /api/bookings` creates a booking as a guest. It requires the traveller's own details (name, contact, pickup, drop-off, time, passengers). Guest bookings are rate-limited. Only submit details the human traveller has explicitly given you and approved. The response contains a booking reference, which is the only handle for that booking. `GET /api/bookings/{ref}` reads a booking by its reference.

## What agents must not do

- Do not sign in or create accounts on the traveller's behalf. Human sign-in is limited to Google and Facebook through `https://api.antalyatransfers.co/api/auth/*`, for people only.
- Do not use any human's session, cookie, or social-login token.
- Do not take payment on the traveller's behalf. Payment, where it applies, is completed by the human on the secure payment page. The MCP server never takes payment. Do not send card details to any endpoint.
- Do not call vendor, admin, driver, or payment-webhook routes (`/api/vendor`, `/api/admin`, `/api/driver`, `/api/payments/*`, `/api/whatsapp/*`).
- Do not send messages (WhatsApp, email, SMS) through the service without the traveller's consent.

## Credential use

There are no agent credentials. MCP, guest booking and public reads are unauthenticated. If a future version issues credentials, this document will be updated before they are issued.

## Contact

Questions about agent access: https://antalyatransfers.co/contact (human support).