# Civic Data authentication

Civic Data does not require an account for free atomic access or accountless x402 payments. Manually issued subscription API keys are available for composed REST, MCP and CLI access. OAuth and OpenID Connect are not used.

## Free operations

Atomic REST and MCP operations are available anonymously, subject to configurable rate limits. Start with the [REST documentation](https://civicdata.co.uk/developers/api) or connect to the [MCP endpoint](https://mcp.civicdata.co.uk/mcp).

## Composed operations

Send a subscribed key as `Authorization: Bearer civic_live_…`. Calls consume the workspace's current included allowance, including cache hits. When no eligible key is supplied, composed operations use the HTTP 402 payment flow (x402). An exhausted recognised key falls back to x402 and returns `X-Civic-Allowance: exhausted`. Payment and entitlement remain gateway decisions, not domain logic.

## OAuth metadata

Civic Data does not publish OAuth authorization-server or protected-resource metadata because no OAuth authorization server exists. Bearer API keys are opaque credentials, not OAuth access tokens.

Security questions: [hello@civicdata.co.uk](mailto:hello@civicdata.co.uk).