# Auth.md — Authentication Guidance for TheCodePlaza

TheCodePlaza currently has no user accounts, OAuth provider, OIDC provider, API keys, or protected-resource metadata.

The browser tools and documented public API endpoints can be used without authentication. Agents should use only the routes listed in the [API catalog](https://thecodeplaza.com/.well-known/api-catalog) and [OpenAPI document](https://thecodeplaza.com/api/openapi.json).

Do not submit secrets, account credentials, or sensitive personal data to any tool. QR and barcode generation, scanning, dialing-code lookup, and many reference functions run locally in the browser. The Website Status Checker sends the URL it checks to the server in order to test its availability.

If authentication is introduced in the future, this document and the discovery headers will be updated before protected endpoints are published.