# Personnel.com auth.md

**No authentication is required, and none is available.**

Every machine-readable surface on this site is public and anonymous.
There is no API key to request, no OAuth client to register, no token
endpoint, and no authorization server. Requests carrying an
`Authorization` header are served exactly as requests without one.

This document is self-contained: because there is no protected resource,
no OAuth Protected Resource Metadata or Authorization Server metadata is
published. Anything an agent needs is below.

## Agent audience

This applies to any automated client reading the public job catalog:
crawlers, MCP clients connecting to `https://personnel.com/mcp`, browser agents using
the WebMCP tools on our pages, and anything calling `https://personnel.com/api/v1`.

Human users signing in to manage jobs, resumes or applications are out of
scope — that is session-based login for people, not agents, and agents
must not use it.

## Supported authentication methods

| Method | Supported |
| --- | --- |
| Anonymous (no credentials) | **Yes — the only supported method** |
| OAuth 2.0 / OIDC | No — no authorization server exists |
| Bearer tokens | No — ignored if sent |
| API keys | No — none are issued |
| mTLS | No |

## Registration and provisioning

There is no registration endpoint and no `register_uri`, because there is
nothing to register for. Start making requests.

For elevated rate limits, bulk access or a data feed, provisioning is
handled by a human: `https://personnel.com/info/contact`

## Credential use

No credentials are issued, accepted, or required. Do not send an
`Authorization` header, do not attempt to sign in as a user, and do not
ask a person for their account credentials in order to act here. Identify
your agent with a descriptive `User-Agent` instead.

## Public endpoints

| Surface | Endpoint | Limit |
| --- | --- | --- |
| REST catalog API | `https://personnel.com/api/v1` | 30 req/min per IP |
| MCP server (Streamable HTTP) | `POST https://personnel.com/mcp` | 60 req/min per IP |
| OpenAPI 3.1 spec | `https://personnel.com/docs/api.json` | — |
| Site overview | `https://personnel.com/llms.txt` | — |
| Sitemap index | `https://personnel.com/sitemap.xml` | — |

MCP server card: `https://personnel.com/.well-known/mcp/server-card.json`

## Why there is nothing to authenticate

The public surface exposes only what an anonymous visitor already sees:
published job postings, the employers who posted them, and job
categories. There is no privileged view for an agent to unlock, so
there is no identity worth proving.

Candidate and application data — resumes, contact details, application
status, messages — sits behind human login and is not reachable by any
agent-facing endpoint, authenticated or not.

## Expected agent behaviour

- Send a descriptive `User-Agent` naming your agent and a contact URL.
- Honour `https://personnel.com/robots.txt`, including its `Content-Signal` directives.
- On `429`, respect `Retry-After` and back off. Do not rotate source
  addresses to evade a rate limit.

## Applying to a job

There is no authenticated apply endpoint, and no unauthenticated one
either. Applying requires a person's own information, entered by that
person. Send them to the posting's `links.html` URL.

## Rules of use

See `https://personnel.com/.well-known/agent-skills/access-policy/SKILL.md`.