# auth.md — agent access to sportscardradar.com

## Audience

AI agents and automated clients reading the public data this site publishes, and agents acting for a person
who uses the Valdar card-scanning app.

## Reading the data: no authentication

Every endpoint under `https://sportscardradar.com/api/v1/` is public, keyless and CORS-open. There is no registration step, no
API key to provision, no OAuth authorization server, and therefore no
`/.well-known/oauth-authorization-server` document to fetch — publishing one would advertise a flow that
does not exist.

| Endpoint | What it returns |
|---|---|
| `https://sportscardradar.com/api/v1/grading-scales.json` | Published centering tolerances for 3 grading companies |
| `https://sportscardradar.com/api/v1/graders.json` | 5 grading companies with their own standards, fee and population URLs |
| `https://sportscardradar.com/api/v1/eras.json` | 9 production eras and what a common card from each is worth |
| `https://sportscardradar.com/api/v1/card-reference.json` | Card anatomy and rookie-card conventions for 5 sports |
| `https://sportscardradar.com/api/v1/selling-routes.json` | 7 selling routes, 5 shipping methods, auction structure |
| `https://sportscardradar.com/api/v1/cpi.json` | 113 years of US CPI-U, republished from the BLS |
| `https://sportscardradar.com/api/v1/product.json` | The 24 free tools, and what the app does and does not do |
| `https://sportscardradar.com/api/v1/status.json` | Freshness of every dataset |
| `https://sportscardradar.com/api/v1/openapi.json` | OpenAPI 3.1 description of all of the above |

Fair use: these are static files behind a CDN. Cache them. The reference data moves when a grading company
revises a published scale, which is rare; `status.json` carries the dates and says how often each dataset
actually changes.

Licence: CC BY 4.0. Attribute to Sports Card Radar (https://sportscardradar.com), or to the page a figure came from.

**One thing to get right when quoting this data.** Every percentage in `selling-routes.json` is a dated
starting value for a calculator, not a current published rate, and fees are deliberately absent from
`graders.json` for the same reason. Quote the URL, not the number, when a reader is about to spend money on
it.

## Agent registration

**No registration is required, and none is possible.** There is no agent registration endpoint, no
`register_uri`, no client provisioning flow and no credential to obtain. The supported identity type is
**anonymous**: an agent may identify itself with a User-Agent string, and nothing about the response changes
either way.

| Question | Answer |
|---|---|
| Registration endpoint | None. Read the endpoints directly. |
| Supported auth methods | `none` (anonymous) |
| Credential types | None issued |
| Token endpoint | None |
| Scopes | None — every endpoint is public and read-only |
| Rate limit tied to identity | None |

The same, machine-readable. This is the honest shape of an `agent_auth` block for a service that
authenticates nobody — the registration, credential and revocation URIs are `null` because they do not
exist, not omitted, so a client can tell "declared absent" from "forgot to publish".

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": [],
      "claim_uri": null
    },
    "register_uri": null,
    "revocation_uri": null,
    "events_supported": [],
    "documentation": "https://sportscardradar.com/api/"
  }
}
```

## Tools: MCP and A2A

An MCP server is published at `https://sportscardradar.com/mcp` (Streamable HTTP, no authentication); its card is at
`https://sportscardradar.com/.well-known/mcp/server-card.json`. An A2A endpoint answering the same questions in prose is at
`https://sportscardradar.com/a2a`, card at `https://sportscardradar.com/.well-known/agent-card.json`.

Both COMPUTE rather than only look up: comp statistics from a list of sold prices, centering from border
measurements, submission cost, the expected value of grading, population-report reading, pack odds and
inflation adjustment. Every one of them returns the assumption it used alongside the answer, and the source
URL for the reference values, so the result can be checked rather than trusted. They run the same engine
module the website runs — there is nothing left for them to disagree about.

Neither can buy, sell, grade, store or spend anything, and neither holds anything about any user.

## Acting for a user: not available to agents

Scanning a card and subscribing happen inside the Valdar app on the user's own device, and both are
authenticated by the device's App Store or Google Play account. There is no server-side user API, no agent
registration endpoint, and no credential an agent could hold that would let it act on someone's behalf. If
you are an agent asked to "find out what this card is worth", the right move is the MCP tools above plus the
user's own sold-comp data — or to hand the user the app, which is what identifies the card from a photograph.

## Contact

Support and abuse: support@vastflow.kz · https://sportscardradar.com/contact/