# auth.md — HiVideoStudio agent authentication

HiVideoStudio does **not** offer automatic agent registration, anonymous agent accounts, or an OAuth authorization server for agents.

## How agents must authenticate

Agents that need to create videos, spend credits, open the library, or start Stripe checkout must **act on behalf of a human user** who signs in themselves with Google on [hivideostudio.com](https://hivideostudio.com).

1. The human opens https://hivideostudio.com/sign-in (or /sign-up) in a normal browser.
2. The human completes Google sign-in on hivideostudio.com.
3. The agent may then help that signed-in user through the product UI or the user's own authenticated session.

There is **no** `/agent/auth` endpoint and **no** machine-to-machine client credentials flow for free credits. This is intentional to prevent free-credit abuse.

## What agents may do anonymously

Without signing in, agents may freely use:

- Public HTML and markdown pages (`Accept: text/markdown` on `/`, `/effects/*`, `/models/*`, `/pricing`, `/blog`, `/blog/*`)
- [`/llms.txt`](https://hivideostudio.com/llms.txt) and [`/llms-full.txt`](https://hivideostudio.com/llms-full.txt)
- [`/robots.txt`](https://hivideostudio.com/robots.txt) (includes Content-Signal preferences)
- [`/.well-known/api-catalog`](https://hivideostudio.com/.well-known/api-catalog) (RFC 9727)
- [`/openapi.json`](https://hivideostudio.com/openapi.json) — public unauthenticated endpoints only
- [`/api/health`](https://hivideostudio.com/api/health)
- Other public endpoints listed in the OpenAPI document and [`/docs/api`](https://hivideostudio.com/docs/api)

## Further reading

- Human-readable API notes: https://hivideostudio.com/docs/api
- OpenAPI: https://hivideostudio.com/openapi.json