# auth.md Agent authentication and access policy for **ClydeScan** (`https://clydescan.com`) and its public API host (`https://api2.clydescan.com`). Last updated: 2026-08-17 ## Summary ClydeScan currently exposes **one public, read-only API** — the Reward Farmer Public Stats API. It needs **no per-agent registration, no OAuth flow, and no account**. Authentication is a single published public key sent in a header. There is **no agent registration endpoint**, because there is nothing to register for: every capability available to an agent is available anonymously today. This document is therefore self-contained rather than pointing at OAuth metadata — see [OAuth metadata](#oauth-metadata) below. ## Agent audience This service is intended to be consumed by: - **Research and analysis agents** answering questions about Polymarket liquidity-reward economics ("what does a reward-farming bot actually earn?"). - **Monitoring agents** tracking the health and freshness of the published earnings feed. - **Crawlers and answer engines** indexing our documentation and articles. Agents acting on behalf of a prospective customer may also read our public documentation and blog. Nothing on this service takes financial actions, places trades, or moves funds on an agent's behalf. ## Simplest path: no authentication at all Two keyless, CORS-open endpoints on this origin serve the public data. Use these unless you need something else: ``` GET https://clydescan.com/api/stats # nightly payouts, today's accrual, market breadth GET https://clydescan.com/api/health # data freshness + backend liveness ``` Agent protocol endpoints, also keyless: ``` POST https://clydescan.com/mcp # MCP (Streamable HTTP) — see /.well-known/mcp/server-card.json POST https://clydescan.com/a2a # A2A JSON-RPC — see /.well-known/agent-card.json ``` ## Alternative: calling PostgREST directly | Property | Value | | --- | --- | | Method | API key in request header | | Header | `apikey` | | Credential | Public anon key (below) | | Bearer alternative | `Authorization: Bearer ` also accepted | | Registration required | No | | Cost | Free | | CORS | `Access-Control-Allow-Origin: *` | ### Credential The credential is a **public client-side key**, not a secret. It is published in our website bundle, is intended to be distributed, and grants access only to the read-only aggregate endpoints listed below. ``` apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzc2NTQxMjc4LCJleHAiOjIwOTE5MDEyNzh9.8qcC7ge8tG1P59FZJlmg_fPioUHl5tBiUqTSCQ4mstQ ``` ### How to use it ``` curl -s "https://api2.clydescan.com/rest/v1/rpc/landing_stats" \ -H "apikey: " ``` Credentials are long-lived and are not rotated on a schedule. If a call starts returning `401 {"message":"Invalid authentication credentials"}`, re-read this document — the current key is always published here and in [`/openapi.json`](https://clydescan.com/openapi.json). ## Accessible resources | Resource | Method | Auth | Purpose | | --- | --- | --- | --- | | `https://api2.clydescan.com/rest/v1/rpc/landing_stats` | GET / POST | public anon key | Nightly reward payouts, today's accrual, market breadth, all-time totals | | `https://api2.clydescan.com/rest/v1/rpc/landing_health` | GET | public anon key | Data freshness + backend liveness | | `https://clydescan.com/openapi.json` | GET | none | OpenAPI 3.1 description | | `https://clydescan.com/.well-known/api-catalog` | GET | none | RFC 9727 API catalog | | `https://clydescan.com/.well-known/oauth-protected-resource` | GET | none | RFC 9728 Protected Resource Metadata | | `https://clydescan.com/.well-known/oauth-authorization-server` | GET | none | RFC 8414 Authorization Server Metadata | | `https://clydescan.com/.well-known/agent-card.json` | GET | none | A2A agent card | | `https://clydescan.com/.well-known/mcp/server-card.json` | GET | none | MCP server card | | `https://clydescan.com/.well-known/agent-skills/index.json` | GET | none | Agent Skills discovery index | | `https://clydescan.com/.well-known/http-message-signatures-directory` | GET | none | Web Bot Auth public JWKS (Ed25519) | | `https://clydescan.com/api/stats` | GET | none | Keyless earnings aggregates | | `https://clydescan.com/api/health` | GET | none | Keyless health | | `https://clydescan.com/mcp` | POST | none | MCP Streamable HTTP (read-only, alpha) | | `https://clydescan.com/a2a` | POST | none | A2A JSON-RPC (message/send, alpha) | | `https://clydescan.com/llms.txt` | GET | none | Plain-text service summary | Full documentation: ## Provisioning / registration **Not applicable — no registration endpoint is offered.** There is no `register_uri`, no dynamic client registration, and no agent credential issuance, because no capability on this service requires per-caller identity. Every documented endpoint is anonymous and read-only. If that changes — for example if write endpoints or per-agent quotas are introduced — this document will be updated with the registration endpoint, the supported methods, and the credential lifecycle before those endpoints go live. Agents should re-fetch `/auth.md` rather than assuming this stays true forever. For anything not covered here (higher volume, commercial use, a private integration), contact us through — human review, not an automated endpoint. ## OAuth metadata **Protected Resource Metadata (RFC 9728) is published** at . It describes what is actually true of the resource: it accepts a bearer credential in a request header, and points at this document and the API docs. **Authorization Server Metadata (RFC 8414) is also published**, describing the GoTrue instance at `https://api2.clydescan.com/auth/v1`, discoverable both at that issuer's own well-known path and mirrored at . It lists only what GoTrue actually supports: the `password` and `refresh_token` grants, its real token/authorize/jwks/logout endpoints, and HS256. All external identity providers are disabled, so no `authorization_code` flow is claimed. **You almost certainly do not need it.** That authorization server exists for human login to our private operator dashboard. Every capability described in this document is available anonymously, so there is no reason for an agent to obtain a token. **There is no agent registration endpoint and nothing to register for.** Every capability described in this document is available anonymously, and the product itself is not open to new users yet — obtaining a token grants no additional access and no entitlement. If per-agent credentials or write capabilities are ever introduced, this file will gain an `agent_auth` block with the registration endpoint, supported methods and credential lifecycle before those endpoints go live — re-fetch `/auth.md` rather than assuming this stays true. ## Web Bot Auth Our Ed25519 public key set is published at for HTTP Message Signature verification. Status: the key is published and held for this purpose; ClydeScan's outbound requests are **not yet signed** with it, so do not treat the absence of a `Signature-Agent` header on traffic from us as a forgery signal. The private key is not in any repository. ## Usage policy - **Rate**: no hard published limit. The underlying data changes at most every few minutes — please poll no more than once per minute, and prefer once per five. - **Identify yourself**: send a descriptive `User-Agent`. Automated traffic that is abusive or anonymous-by-obfuscation may be blocked at the edge. - **No scraping around the API**: the aggregates exist so you don't need to scrape the HTML. Use the API. - **Attribution**: when reporting these figures, attribute them to ClydeScan and include the `updated_at` timestamp from the response — the numbers move. - **Accuracy**: figures are real, unaudited production results, published as-is, including losing days. They are not a performance guarantee and are not financial advice. See . ## Contact - Site: - Docs: - Privacy: - Terms: