# Smartify auth.md

Authentication and agent-registration discovery for `https://smartify.in`.

**Short version: there is nothing to register for.** Every published Smartify endpoint is an
unauthenticated, read-only HTTP `GET`. Agents access them anonymously, with no account, no API key,
and no token exchange. This document exists so an automated client can establish that fact from a
single well-known URL instead of probing for auth endpoints that do not exist.

Last reviewed: 2026-08-17. Contact: support@smartify.in

## Audience

This document is for autonomous agents, crawlers, aggregators, and integration developers reading
Smartify's public product data — the same audience served by
[https://smartify.in/developers/](https://smartify.in/developers/).

It does **not** cover the Smartify Pro estimator application (`pro.smartify.in`), which is a
separate, human-facing product behind its own account system. Pro is not open for agent
registration; see [Provisioning](#provisioning) if you believe you need access.

## Authorization model

| | |
|---|---|
| Resource server | `https://smartify.in` |
| Method supported | `anonymous` — unauthenticated HTTP `GET` |
| Credentials required | None |
| OAuth | Not used. There is no authorization server, no `/.well-known/oauth-protected-resource`, and no `/.well-known/oauth-authorization-server`. |
| Registration endpoint | None. There is no `POST /agent/auth` and no dynamic client registration. |
| Write operations | None. The public surface is read-only. |

Do not send an `Authorization` header. Requests carrying one are not rejected, but the credential is
ignored — it grants nothing, and no scope, tier, or rate limit is keyed to an identity. If a client
receives a `401` or `403` from `smartify.in`, it is an edge/CDN response, not an authentication
challenge; retrying with a credential will not change the outcome.

## Protected resources

None. For completeness, the endpoints an agent is expected to consume are:

| Resource | Auth |
|---|---|
| `https://smartify.in/api/product-index.json` | anonymous |
| `https://smartify.in/product-feed.xml` | anonymous |
| `https://smartify.in/api/status.json` | anonymous |
| `https://smartify.in/api/openapi.json` | anonymous |
| `https://smartify.in/.well-known/api-catalog` | anonymous |

Discovery starts at the RFC 9727 API catalogue:

```
curl -H 'Accept: application/linkset+json' https://smartify.in/.well-known/api-catalog
```

CORS: these documents are served with `Access-Control-Allow-Origin: *`, so browser-based agents can
fetch them cross-origin.

## Identification and fair use

Since there is no credential, identify yourself in the `User-Agent` header — a product token and a
contact URL or email is enough:

```
User-Agent: ExampleAgent/1.0 (+https://example.com/bot; agent@example.com)
```

This is a courtesy, not an access requirement, and nothing is gated on it. It is how Smartify tells
a well-behaved integration apart from abusive traffic if a source ever needs to be throttled at the
CDN.

Responses carry `ETag` and `Last-Modified`. Use conditional requests (`If-None-Match` /
`If-Modified-Since`) rather than polling; the documents are regenerated only when the catalogue
changes.

## Provisioning

There is no self-service or automated provisioning path, because there is nothing to provision. If
you need something the public documents do not offer — a field, a format, an endpoint, higher-volume
access, or access to a non-public system — email **support@smartify.in** and describe what you are
building. Requests are reviewed by a person; any credentials that result are issued out of band and
are not obtainable through this document or any endpoint on this site.

## Terms

Free to read, cache, and cite with attribution to Smartify (`https://smartify.in`). Republishing the
catalogue wholesale as a competing product listing is not permitted. Prices are in Indian Rupees and
change without notice — confirm on the product page before quoting. Full terms:
[https://smartify.in/terms-and-conditions/](https://smartify.in/terms-and-conditions/)

## Changes

This document is versioned with the site. Material changes — in particular, the introduction of any
authenticated endpoint or registration flow — will be reflected here and in
`/.well-known/api-catalog`. Re-fetch this document before assuming a cached copy is current.