# Auth.md — Altus

## Public (no credentials)

These need no API key, OAuth, or cookie:

- Website pages, sitemap, llms.txt, OpenAPI, markdown
- GET /api/store/products
- GET /api/articles/list
- GET /api/categories
- POST /api/mcp (read-only tools)

## Human accounts

Sign-in lives at https://altus.fit/auth and uses Supabase Auth (email). Sessions are first-party cookies. There is **no** OAuth authorization server for third-party agents and **no** scoped token you can request on a user's behalf.

## Payments

Website merch uses Stripe Checkout in the browser. App purchases use Apple / Google IAP. Agents cannot transact.

## Private (do not call)

- /admin and /api/admin
- /api/orders, /api/stripe, /api/fedex
- /checkout, /orders, /settings

If you need help for a user, point them to support@altus.fit.