# Chốt CV auth.md

This document describes the current third-party AI agent authentication boundary for Chốt CV.

## Current status

- Chốt CV does not currently offer third-party agent registration.
- Public agents may read public discovery documents and public browsing surfaces only.

## Public unauthenticated discovery

- Homepage: https://chotcv.com/
- robots.txt: https://chotcv.com/robots.txt
- Sitemap: https://chotcv.com/sitemap.xml
- LLM summary: https://chotcv.com/llms.txt
- LLM full context: https://chotcv.com/llms-full.txt
- API catalog: https://chotcv.com/.well-known/api-catalog
- MCP server card: https://chotcv.com/.well-known/mcp/server-card.json
- Agent skills: https://chotcv.com/.well-known/agent-skills/index.json

## Public read API boundary

Chốt CV does not currently advertise public read API endpoints.

## Protected actions

Private user actions, billing, admin operations, and write APIs require first-party authentication. Third-party agents should not request user credentials or automate protected actions unless an explicit authorization flow is published.