# Auth.md

## Authentication and human verification for abuenoben

Canonical documentation: https://abuenoben.com/developers

abuenoben does not offer user accounts, agent registration, API keys, OAuth, OpenID Connect or autonomous login. There is no authenticated customer area and no credential that an agent should request, store or invent.

## Agent registration

Agent registration is not available or required. There is no registration URL, client identifier or account-creation flow. Agents should use the public resources below without an account.

## Agent login

Agent login is not available or required. There is no login URL, session cookie, bearer token or delegated user identity for this website.

## Public website

All commercial pages, case studies, guides and machine-readable resources are public over HTTPS. They require no authentication.

## Contact form

`POST https://abuenoben.com/api/contact` is the backend of the public project-brief form. It is not a general-purpose submission API.

A valid submission requires:

- an allowed `Origin` from the abuenoben website;
- `Content-Type: application/json`;
- a short-lived Cloudflare Turnstile token issued by the public form;
- explicit privacy consent;
- compliance with spam and rate-limit controls.

The complete request and response schemas are published at https://abuenoben.com/openapi.json. Rate-limit policy is returned in the `RateLimit-Policy` header; a `429` response also returns `Retry-After`.

## Guidance for agents

An agent may read the public site, prepare a concise brief and bring the responsible person to https://abuenoben.com/contacto for review and submission. An agent must not fabricate Turnstile tokens, bypass origin or spam checks, submit bulk messages, transmit secrets, or claim that abuenoben supports autonomous authentication.