# auth.md

This file is for an automated client — a crawler, an agent, or anything else
reading `https://auroraisyours.com` without a person watching — that wants to
know which credentials this origin expects before it asks for something. The
answer is none, and the rest of this document explains where that leaves you.

## Everything served here is public

Every document on this origin is published on purpose and needs no credential,
no account and no session. Fetch it. There is nothing to sign in to because
there is nothing behind a sign-in: this is Aurora's marketing site, Aurora has
no user accounts, and the app it describes keeps recordings, transcripts and
summaries on the user's own iPhone rather than in an account here.

Reading the site without executing JavaScript is the supported case, not a
degraded one, and there is a machine-readable layer that makes it cheap:

- `/llms.txt` describes Aurora and links every page in its markdown form;
  `/blog/llms.txt` does the same scoped to the writing.
- Every HTML page has a markdown twin at the same URL with the extension
  swapped — `/` is also `/index.md`, `/privacy/` is also `/privacy/index.md`,
  and `/blog/no-meeting-bot` is also `/blog/no-meeting-bot.md`. Each page
  advertises its own with `<link rel="alternate" type="text/markdown">`. The
  twins are generated from the pages at build, so they say what the pages say.
- `/api.md` documents the one endpoint below, including what it answers when a
  client has no Turnstile token to send.
- `/sitemap.xml` lists every page, `/feed.xml` is the blog's RSS.
- `/robots.txt` allows every crawler everything, search and training alike.
- `/.well-known/security.txt` follows RFC 9116.

## One endpoint accepts a write, and a human has to be present for it

`POST /api/access` is the only path on this origin that sends anything
anywhere. Given an email address it asks Brevo to put the public TestFlight
link in that inbox and, when the visitor asked for it, to begin a double
opt-in for build notes. It is gated by a Cloudflare Turnstile token, which a
browser obtains by putting a challenge in front of the person at the keyboard;
the Worker verifies that token with Cloudflare before it does anything else,
and a request carrying no valid token is refused.

So there is no credential to issue you, no registration to perform and no key
to rotate. The gate is not identity, it is the presence of a human in a
browser, and an unattended client cannot pass it. That is deliberate rather
than an oversight. If you are acting for someone who wants the beta, send them
to `/beta/` and let them do it themselves — the TestFlight link is printed on
that page as well, so nothing about it is secret.

## There is deliberately no OAuth metadata

This origin publishes no `/.well-known/oauth-protected-resource` and no
`/.well-known/oauth-authorization-server`. Their absence is a statement, not a
gap someone forgot to fill: Aurora runs no authorization server, no token
endpoint, no JWKS and no client registration, on this origin or any other.
Publishing that metadata would mean naming an issuer and endpoints that do not
exist, and sending an agent to an issuer that answers nothing is worse than
telling it plainly that there is none. If either document ever appears here, it
will be because the service behind it does.

## Contact

Questions about this file, or anything security-related, go to
hello@auroraisyours.com — the address `/.well-known/security.txt` already
names.