# RentSeek Evidence authentication

RentSeek Evidence supports anonymous latest-year reads, account API keys, and OAuth 2.1 for interactive MCP clients.

## Anonymous access

- Latest-year single-ticker facts: `GET https://rentseek.ing/t/{ticker}/facts`
- MCP: `list_available_tickers` and latest-year `get_executive_compensation`
- Rate limit: 60 requests/minute per anonymous client

Historical facts require an API key. Human HTML ticker pages remain public and keep their full visible history.

## API key

Create and manage keys at https://rentseek.ing/developers. Send the key in this header:

```http
X-API-KEY: <api-key>
```

- Scope: `executive-compensation:read`
- Rate limit: 600 requests/minute per valid key
- The same key works for REST and the remote MCP server.

## OAuth 2.1 + Dynamic Client Registration

Use OAuth for interactive MCP clients that can open a browser for sign-in and consent.

- Authorization server: `https://rentseek.ing`
- Protected resource: `https://rentseek.ing/mcp`
- Protected resource metadata: `https://rentseek.ing/.well-known/oauth-protected-resource`
- Dynamic Client Registration: `https://rentseek.ing/oauth/register`
- Authorization endpoint: `https://rentseek.ing/oauth/authorize`
- Token endpoint: `https://rentseek.ing/oauth/token`
- Scope: `executive-compensation:read`
- Rate limit: 600 requests/minute per valid access token

The MCP endpoint accepts exactly one authentication mode per request. Send an OAuth Bearer token or `X-API-KEY`, never both.

The canonical endpoint is `https://rentseek.ing/mcp`. Treat `https://mcp.rentseek.ing/mcp` only as an optional legacy alias; clients should default to the apex endpoint.

## Credits and exhaustion

The first credentialed principal grants 100 lifetime credits to the user: first API key creation or first OAuth grant, whichever happens first. Both modes use the same user balance, credit costs, and HTTP 402 flow.

When the balance is insufficient, inspect `purchase.status`. If it is `coming_soon`, tell the human that evidence packs are launching soon and point them to https://rentseek.ing/developers for early access. Keep the same API key or OAuth connection for when packs launch. Authentication failures use the flat `{ "error": string, "message": string }` envelope.

## Links

- Agent onboarding: https://rentseek.ing/agent-onboarding/SKILL.md
- Pricing: https://rentseek.ing/pricing.json
- MCP documentation: https://rentseek.ing/api/mcp.md
- OpenAPI: https://rentseek.ing/openapi.json