# auth.md — THORChain Swap

How agents authenticate against THORChain Swap (https://swap.thorchain.ai): anonymously, always. This site issues no credential of any kind and accepts none; calls are rate limited per client.

## Audience

Agents and developers using the public THORChain Swap web interface, its public MCP server, and its public support APIs.

## Current Authentication Model

The public web interface requires no account authentication for browsing. Wallet connection and transaction signing are performed by user-controlled wallets in the browser; memoless ("instant") swaps work without connecting a wallet.

The public MCP server at https://swap.thorchain.ai/mcp and the public support APIs are anonymous and rate limited per client. No credential issued by this site can move funds, sign a transaction, or read anything that is not already public.

The swap aggregator backend that powers the UI (https://api.thorchain.org/v1) is separate: it requires an `x-api-key` header. Keys are free and issued through the affiliate program — register at https://affiliate.thorchain.org with your name, email, website, and Telegram, verify the email, and the key is issued once the account is approved. The same account sets affiliate/service fee splits, embeds the swap widget, and tracks earnings. The memoless API (https://api.thorchain.org/memoless/api/v1) requires no API key.

## Which Credential Do I Need?

Two different things, often confused:

| Want to | Need | How |
| --- | --- | --- |
| Read quotes, pools, network state | Nothing at all | Call https://swap.thorchain.ai/mcp directly |
| Build a swap flow on the aggregator, earn affiliate fees, embed the widget | An `x-api-key` for https://api.thorchain.org/v1 | Apply at https://affiliate.thorchain.org (free, reviewed) |

## No Authorization Server

This site runs no authorization server and issues no tokens. There is deliberately **no** `/.well-known/oauth-protected-resource` and **no** `/.well-known/oauth-authorization-server`: an MCP client that probes for them finds nothing, concludes the server is open, and connects. Publishing that metadata for a server that needs no credential only makes connectors attempt a sign-in flow that has nothing to sign in to.

Add the MCP server to any client with the URL alone:

```bash
claude mcp add --transport http thorchain-swap https://swap.thorchain.ai/mcp
```

If a client asks for an OAuth client ID, API key, or bearer token for https://swap.thorchain.ai/mcp, leave it blank — none exists.

## Partner API Keys

The swap aggregator behind the UI (https://api.thorchain.org/v1) is a separate system and does take an `x-api-key`. Keys are free through the affiliate program: register at https://affiliate.thorchain.org with your name, email, website, and Telegram, verify the email, and the key is issued once the account is approved. That account also sets affiliate/service fee splits, generates the embeddable widget, and reports earnings. Nothing on this site issues or replaces that key.

## Discovery Metadata

- API catalog: https://swap.thorchain.ai/.well-known/api-catalog
- MCP server card: https://swap.thorchain.ai/.well-known/mcp/server-card.json

## More

Full documentation: https://swap.thorchain.ai/developers/auth (markdown: https://swap.thorchain.ai/developers/auth.md). Developer portal: https://swap.thorchain.ai/developers (markdown: https://swap.thorchain.ai/developers.md).