[Skip to content](#main-content) Features [Land Lead Management](/features/land-lead-management)[Field Execution](/features/field-execution)[Pricing Intelligence](/features/ai-pricing)[Document Verification](/features/document-verification)[Task Management](/features/task-management)[Competitor Intelligence](/features/competitor-intelligence)[Location Intelligence](/features/location-intelligence)[Smart Dashboard](/features/smart-dashboard)[Audit Trail](/features/audit-trail)[View all features](/features) Solutions For your business [Real Estate Developers](/solutions/real-estate-developers)[Banks & NBFCs](/solutions/banks-nbfcs)[Land Valuation Teams](/solutions/land-valuation-teams)[Legal Teams](/solutions/legal-teams) For your team [Decision Maker](/roles/decision-maker)[Team Lead](/roles/team-lead)[Field Team](/roles/field-team) By Use Case [Land Acquisition](/solutions/land-acquisition)[Site Analysis](/solutions/site-analysis)[Portfolio Management](/solutions/portfolio)[View all roles](/roles) Compare [Proquiro vs Excel](/vs/excel)[Proquiro vs Google Sheets](/vs/google-sheets)[Proquiro vs WhatsApp](/vs/whatsapp-tracking)[Proquiro vs Manual Process](/vs/manual-process)[Proquiro vs LAMS](/vs/lams)[Proquiro vs ERP](/vs/erp) Resources [Land Area Converter](/tools/land-area-converter)[Price Per Sq Ft](/tools/price-per-sqft-calculator)[ROI Calculator](/tools/land-roi-calculator)[OSR Calculator](/tools/osr-calculator-india)[Due-Diligence](/tools/land-due-diligence-checklist)[Site Visit](/tools/site-visit-checklist)[Legal Documents](/tools/document-readiness-checker)[Excel Template](/tools/excel-template)[All tools](/tools) [Pricing](/pricing) [ Sign in ](https://app.proquiro.com)[Request a Demo](/contact/sales)[Start at ₹639/mo](https://app.proquiro.com/users/sign%5Fup?plan=solo) [Developer resources](/developers)› Authentication # Proquiro Agent Authentication Guide This page explains how AI agents authenticate against Proquiro endpoints. The Proquiro public API and MCP server are intentionally **unauthenticated** at this time — they expose marketing form handlers and stateless calculator tools. Authenticated API access for the hosted Proquiro app is available to design partners on request. ## Authentication model at a glance | Surface | Auth required? | Identity carried as | Rate limit | | --------------------------- | ------------------------------ | ------------------------------ | ------------------------------------------- | | /api/v1/demo-request | No | User-Agent \+ IP | 5 req / IP / hour | | /api/v1/health | No | — | 300 req / IP / min (global /api/\* ceiling) | | /mcp (MCP server) | No | Mcp-Session-Id header | Fair-use | | /agent/identity, /oauth2/\* | No (they issue the credential) | — | Fair-use | | Hosted app data API | Yes (on request) | Bearer token (partner program) | Negotiated | Because the public surface is unauthenticated, agents do _not_ need to obtain an API key for the resources documented at . Identification is done via headers and IP-based rate limiting. An **optional** registration flow is available for agents that want a stable, revocable identity rather than a bare `User-Agent` string. It follows the [auth.md](https://workos.com/auth-md) profile over RFC 9728 / RFC 8414 discovery, and offers the`anonymous` identity type only — this domain has no user accounts, so there is no claim ceremony and no agent-provider trust list. A token grants nothing an anonymous caller does not already have and does not raise any rate limit. Machine walkthrough: . Summary and examples:. ## Step 1 — Identify your agent Send a descriptive `User-Agent` on every request. Include the agent name, version, and a contact URL or email so we can reach you about abuse, policy issues, or quota uplift requests. This is the single most important authentication signal for unauthenticated requests. ``` User-Agent: AcmeAgent/1.4 (+https://acme.example/agents) ``` Generic User-Agents (curl, python-requests, headless-browser defaults) are rate-limited more aggressively and may be blocked entirely if abusive. For a machine-verifiable identity instead of a self-reported string, register once and present the resulting bearer token alongside your `User-Agent`: ``` npx proquiro auth register # prints an access_token you can export ``` ## Step 2 — Calling unauthenticated endpoints No tokens are needed. Send a JSON body with `Content-Type: application/json` and read structured JSON errors back. All errors include a stable`error.code`, a human `error.message`, an optional`error.hint`, and a `error.docs` URL. ``` curl -sS https://proquiro.com/api/demo-request \ -H 'User-Agent: AcmeAgent/1.4 (+https://acme.example/agents)' \ -H 'Content-Type: application/json' \ -d '{ "name": "Jane Doe", "email": "jane@company.com", "phone": "+91 99000 00000" }' ``` Successful responses return `200` with `application/json`. Failures use the appropriate HTTP status code (`400`, `409`,`429`, `500`) with this shape: ``` { "error": { "code": "RATE_LIMITED", "message": "Too many requests from this network. Please try again later.", "hint": "Limit: 5 requests per IP per hour.", "docs": "https://proquiro.com/developers#proquiro-public-api" } } ``` On `429 RATE_LIMITED`, the `Retry-After` header indicates how long to wait before retrying. Honor it. Every `/api/*` endpoint response also carries live `RateLimit-Limit` / `RateLimit-Remaining` /`RateLimit-Reset` / `RateLimit-Policy` headers for proactive self-throttling — see [rate limits](/developers#proquiro-rate-limits). ## Step 3 — Connecting an MCP client The Proquiro MCP server uses the **Streamable HTTP** transport at`POST https://proquiro.com/mcp`. No bearer token is required. Sessions are identified by an `Mcp-Session-Id` header that the server issues on the first response — pass it back on subsequent requests to keep a session alive. Capability handshake (initialize) example: ``` curl -sS https://proquiro.com/mcp \ -H 'User-Agent: AcmeAgent/1.4 (+https://acme.example/agents)' \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "initialize", "params": { "protocolVersion": "2025-06-18", "capabilities": {}, "clientInfo": { "name": "AcmeAgent", "version": "1.4" } } }' -i ``` The response carries `Mcp-Session-Id` and`Mcp-Protocol-Version` headers. If you set`Accept: text/event-stream`, replies are streamed as SSE; otherwise they come back as JSON. For the full server card (transport, capabilities, tools), fetch. ## Step 4 — Higher-volume access (partner program) For agent platforms, integrators, and ISVs that need higher rate limits, authenticated hosted-app data access, or co-development on agent workflows, contact the Proquiro team: - Email [info@proquiro.com](mailto:info@proquiro.com) with subject "Partner API access — " - Include: agent name, expected request volume, target endpoints, identifying`User-Agent`, and a contact URL - We issue Bearer tokens scoped to specific endpoints and quotas. Tokens are passed as `Authorization: Bearer ` on every request and rotated on request Partner tokens are **not** available via self-service signup today. This is by design — it keeps the public surface low-noise while we onboard integrations one at a time. ## Operational guardrails for agents - **Idempotency:** the lead-capture endpoints dedupe on email + tool slug. Repeated submissions return `409 DUPLICATE_REQUEST` rather than inserting duplicates - **Honeypot:** the `website` field must be empty. Submitting any value triggers `400 HONEYPOT_TRIGGERED` - **Disposable email rejection:** mailinator-class domains are rejected with`400 DISPOSABLE_EMAIL` - **CORS:** all Proquiro public endpoints set`Access-Control-Allow-Origin: *`, so browser-resident agents can call them - **HTTPS-only:** every endpoint is served over TLS. HTTP requests are redirected See also: [Proquiro AI Policy](/ai-policy),[Privacy Policy](/privacy), and[Terms / MSA](/terms).