# Moltern auth.md

This document describes public authentication expectations for AI agents and integration developers.

## Audience

Moltern is a deployment platform for human users and teams. The public website, public docs, service docs, service catalog API, sitemap, and agent skills can be read without authentication. Workspace dashboards and customer data require explicit user authentication.

## User Authentication

Moltern account access is handled through the product UI:

- Sign in: https://moltern.com/login
- Register: https://moltern.com/register
- Dashboard after sign-in: https://moltern.com/dashboard
- Platform docs: https://docs.moltern.com/auth-and-account-access

Depending on product configuration, Moltern can show email/password sign-in, Google sign-in, and GitHub sign-in. Email registration requires email verification before normal product access.

## GitHub Repository Access

GitHub login and GitHub repository access are separate flows. Users connect repositories by installing the Moltern GitHub App from the Moltern application creation flow. Repository access should be limited to the repositories the user wants Moltern to deploy.

## Agent And API Access

Moltern does not currently publish a public autonomous agent registration endpoint or machine-to-machine credential issuance flow. Agents should not attempt to create accounts, request credentials, or access private workspace APIs on behalf of a user outside the normal authenticated product flow.

## Public Resources For Agents

- Public site guide: https://moltern.com/llms.txt
- API catalog: https://moltern.com/.well-known/api-catalog
- Public OpenAPI description: https://moltern.com/.well-known/moltern-public-api.openapi.json
- Agent skills index: https://moltern.com/.well-known/agent-skills/index.json
- Service catalog API: https://moltern.com/public/templates

## Protected Resources

Authenticated routes such as dashboard, applications, services, billing, webhooks, projects, environments, and private API endpoints are user-specific. Agents should only access them with explicit user authorization through Moltern and should never request passwords, one-time codes, private keys, webhook secrets, or repository tokens in chat.