Auth

Anonymous calls work today. POST /v1/tutor and POST /mcp tools/call send RateLimit-Policy: "tutor";q=10;w=60 and RateLimit. The window is one client (CF-Connecting-IP), enforced by the Workers Rate Limiting binding TUTOR when that binding is present, and by an in-memory window otherwise. GET documentation, initialize, and tools/list are not counted.

An ipa_live_ key raises the window to "tutor";q=120;w=60 on binding TUTOR_KEY, counted per key rather than per IP. Send it as Authorization: Bearer ipa_live_... or X-API-Key. The same headers work on POST /v1/tutor and POST /mcp. A missing key stays anonymous. An unrecognized or malformed key is 401 api-key-rejected, not the anonymous tier. scripts/mint_key --label beta-1 prints a secret once and stores sha256: plus the hex digest. The record keeps the label, a short prefix, created_at, audio_count, and ipa_count. Audio is audio_base64, audio_url, an upload PUT, or create_upload. An ipa field counts as IPA, including when audio is also sent. No route lists secrets.

This host does not serve /.well-known/oauth-protected-resource. Advertising that file would tell clients that authorization is required and would break the anonymous tier. Do not add it until an authorization server exists.

Later: MCP OAuth 2.1

Design only. This build does not implement an authorization server, a token endpoint, or Dynamic Client Registration.

The target is the MCP authorization spec, 2026-07-28, which sits on OAuth 2.1. Both are drafts relative to a finished RFC for the MCP profile.

Client registration prefers Client ID Metadata Documents over Dynamic Client Registration (RFC 7591). The authorization server should advertise client_id_metadata_document_supported. DCR stays a deprecated fallback. Notes: MCP blog, client registration.

Refresh tokens, from SEP-2207:

Clients should include refresh_token in grant_types.
A client may request the offline_access scope only when the authorization server lists it in scopes_supported.
The resource server should not advertise offline_access.
Public clients must rotate refresh tokens (OAuth 2.1 section 4.3.1).

When that server exists, the anonymous tier stays for callers with no key, still at 10 requests per 60 seconds, until a tighter account limit replaces it.