# lensdrop.app auth.md

How authentication and agent registration work on Lensdrop.

## Agent audience

AI agents reading or citing Lensdrop's public content: [llms.txt](https://lensdrop.app/llms.txt), the markdown twins of the marketing pages, and the read-only content API described by [openapi.json](https://lensdrop.app/openapi.json), listed in [/.well-known/api-catalog](https://lensdrop.app/.well-known/api-catalog), and documented at [/developers](https://lensdrop.app/developers).

## Registration and provisioning endpoints

None. Lensdrop has no agent registration endpoint, no provisioning endpoint, no OAuth authorization server, and no protected-resource metadata. Registration is not required for any public resource, and there is nothing an agent could register for.

## Supported methods

One method: anonymous access.

```json
{
  "identity_types_supported": [
    "anonymous"
  ],
  "anonymous": {
    "credential_types_supported": [
      "none"
    ],
    "claim_uri": "https://lensdrop.app/openapi.json"
  }
}
```

The identity type is anonymous, no credential is issued (`credential_types_supported: ["none"]`), and the claim URI is the OpenAPI description of what anonymous access covers. Send plain GET requests. Anonymous access is rate limited per client (120 requests per 60 seconds; see the RateLimit headers) and versioned by the API-Version header.

## Credential use

No credentials are issued, accepted, or required. Requests carry no API keys, no bearer tokens, no cookies. Photographer accounts are created by people through Google sign-in and are off limits to agents; client galleries are unguessable, PIN-protected links that an agent should only open when its user was given the link and PIN.

## Contact

Questions about agent access: hello@lensdrop.app