# Authentication — 1VPS API

**There is none, and that is deliberate.**

The 1VPS public API, MCP server, and markdown mirrors are open, unauthenticated,
and read-only. There is no signup, no API key, no OAuth flow, and no token to
rotate. If something asks you for a 1VPS credential, it is not us.

- Base URL: `https://1vps.com`
- Auth scheme: **none**
- Credentials accepted: **none** — do not send `Authorization`, cookies, or keys
- CORS: `Access-Control-Allow-Origin: *`, so browser-side agents can call directly
- Transport: HTTPS only (HTTP redirects with 301)

## Quickstart

```sh
curl -s https://1vps.com/api/providers.json
```

That is the whole authentication walkthrough. No preceding step, no token
exchange, no header.

For MCP, connect to `https://1vps.com/mcp` over Streamable HTTP and send
`initialize` immediately — the server declares `"authentication": {"type":
"none"}` in its [server card](https://1vps.com/.well-known/mcp/server-card.json)
and will never issue a `401`.

## Why there is no auth

The API serves published editorial data — the same provider ratings, pricing,
and guides that anyone can read on the website. There is nothing user-specific
to protect, no account to scope, and no write path to guard. Adding a key would
buy us analytics at the cost of making every agent integration harder.

## Scopes and permissions

Not applicable. Every caller sees exactly the same data. There is no privileged
tier, no partner access, and no way to request elevated permissions.

## Rate limits

600 requests per 60 seconds per client. Every response carries the RFC 9331
headers:

| Header | Meaning |
| --- | --- |
| `RateLimit-Limit` | Requests allowed in the current window |
| `RateLimit-Remaining` | Requests left |
| `RateLimit-Reset` | Seconds until the window resets |
| `RateLimit-Policy` | `600;w=60` |
| `Retry-After` | Sent with any `429` |

Self-throttle from these headers. A `429` is not an auth failure — retry after
the interval rather than looking for a credential.

## Errors

Failures under `/api/` are always JSON, never an HTML page:

```json
{
  "error": {
    "code": "not_found",
    "message": "No API resource matches /api/providers/nope.json.",
    "status": 404,
    "resolution": "List available endpoints at https://1vps.com/api/index.json.",
    "documentation": "https://1vps.com/developers/"
  }
}
```

`code` is stable and machine-readable; `resolution` tells you what to change.
There is no `401` or `403` in the error vocabulary because there is nothing to
authenticate against.

## Testing

Production **is** the sandbox. Every endpoint is read-only and idempotent, so
there is no separate test environment to configure, no test keys, and no risk of
mutating anything by calling it. Point your integration tests straight at
`https://1vps.com` — just stay inside the rate limit.

## Contact

Questions about integrating: hey@1vps.com
Full documentation: <https://1vps.com/developers/>