# Fairly auth.md

How AI agents and automated clients authenticate to Fairly (https://fairly.day). Last reviewed 2026-10-03.

## Who this is for

Agents that read fairly.day, connect to its MCP server or A2A agent, or call the Fairly API.

## Supported methods

| Surface | Method | Credential |
| --- | --- | --- |
| Web pages, Markdown twins, https://fairly.day/llms.txt | anonymous | none |
| MCP server, https://fairly.day/mcp (read-only) | anonymous | none |
| A2A agent, https://fairly.day/a2a (read-only) | anonymous | none |
| WebMCP tools on fairly.day pages | anonymous, in the user's browser | none |
| Discovery documents under https://fairly.day/.well-known/ | anonymous | none |
| Fairly API, https://api.fairly.day (accounts, groups, expenses) | not available to agents | see below |

Anonymous surfaces need no registration, key or header. They are read-only: nothing an agent does
through them changes anyone's data.

## Registration and provisioning

There is no agent registration endpoint and no self-service provisioning. The Fairly API serves
Fairly's own iOS and Android apps. It authenticates with an opaque session handle (`Authorization:
Bearer fs_…`) that it issues only to those apps after the person signs in on their phone, so no
third-party OAuth client, API key or service account exists. Its OpenAPI description is public
(https://api.fairly.day/openapi.json) so its shape can be read, not so it can be called on someone's behalf.

- Do not ask a person for their Fairly sign-in code, password or session handle, and do not drive
  the app's sign-in flow for them.
- People who are not on Fairly can settle a debt from the link a friend sends them
  (`https://fairly.day/s/…`). That link is the credential: it opens one page, for one pair of people. Agents
  should only open one that the person themselves has shared.

To ask about API access for an integration, write to hello@fairly.day.

## Bots Fairly sends

Obsurvive, which makes Fairly, signs its bots' requests with HTTP Message Signatures (Web Bot
Auth). The public keys are at https://fairly.day/.well-known/http-message-signatures-directory

## Related

- What each API is and where it is described: https://fairly.day/.well-known/api-catalog
- Developer and agent overview: https://fairly.day/developers
- Skills for agents: https://fairly.day/.well-known/agent-skills/index.json