# Authentication for SW Accounting agent interfaces

Every agent interface on sw-cpas.com is public and read-only. **No credentials are needed**: there is no API key to create, no OAuth flow and no account to register. Send requests without an Authorization header.

## Interfaces that need no credentials

- Public API: https://sw-cpas.com/wp-json/swc/v1/ (contract: https://sw-cpas.com/openapi.json)
- MCP servers (Streamable HTTP): https://sw-cpas.com/mcp and https://sw-cpas.com/mcp/docs
- Ask endpoint: https://sw-cpas.com/ask?query=your+question
- Markdown pages, llms.txt and the agent skill: https://sw-cpas.com/agents.md

Machine-readable form: https://sw-cpas.com/.well-known/oauth-protected-resource (RFC 9728 metadata with no authorization servers and an empty `bearer_methods_supported`).

## Command-line tool

`npx github:samorj16-bot/sw-cpas-agent-tools help` (source and agent plugin: https://github.com/samorj16-bot/sw-cpas-agent-tools). It also needs no credentials.

## Limits

Per IP address: 60 requests per minute for the API, 30 for /ask and /a2a, 120 for MCP. Responses carry RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. Over the limit the server answers HTTP 429 with Retry-After; wait that many seconds and retry.

## What agents cannot do here

There are no client accounts behind these interfaces. An agent cannot view a client's records, file a return or pay an invoice through them, and should never send Social Security numbers, bank details or tax documents to them.

## Becoming a client

A person starts an engagement by calling (323) 991-8581, emailing swyoun@sw-cpas.com or sending the form at https://sw-cpas.com/contact/.