# Authentication for automated agents

Camel STEAM public website: **https://www.camel.hk**

## Public site (no login)

There is **no account, OAuth, API key or session** required to read public pages, the sitemap, `llms.txt`, or the public JSON APIs listed in `/.well-known/api-catalog`.

Human visitors may submit:

- School quotation form: `https://www.camel.hk/quote.html` (HTML form, CSRF not required for agents to *read* the page)
- Contact via email `edu@cs.hk` or WhatsApp `+852 5531 5000`

Agents should **not** submit quotation, lead, or newsletter forms unless a human explicitly requested that action.

## Public read-only APIs

Unauthenticated `GET`:

- `/api/public/settings`
- `/api/public/courses?seg=kg|pri|sec|sen`
- `/api/public/faqs`

These return JSON `{ "ok": true, "data": ... }`. They are not an authenticated agent workspace.

## What is out of scope

- There is **no** public OAuth Authorization Server, MCP server, or A2A agent endpoint for this brand site.
- Staff CMS and server control panels are on a separate, IP-restricted host and are **not** available to crawlers or third-party agents.
- Do not probe `/admin`, `/api/admin`, `/api/auth`, or `/api/quotes` on www.camel.hk; those paths are not a public agent API.

## Preferred discovery order

1. `https://www.camel.hk/robots.txt` (Content-Signal policy)
2. `https://www.camel.hk/llms.txt`
3. `https://www.camel.hk/sitemap.xml`
4. `https://www.camel.hk/.well-known/api-catalog`
5. Page fetch with `Accept: text/markdown` for a compact text copy