# Authentication

Source: https://joinopenfile.com/docs/authentication
Index: https://joinopenfile.com/llms.txt

The API has no accounts or keys yet. The owner's dashboard sign-in doesn't apply here.

**Public endpoints** need nothing: plans, pricing, states, services, classes, marks, sites, filing types, docs and quotes. They're limited per IP address.

**Formations, orders, applications and filings** each have their own token. Send it as a bearer token:

```bash
curl https://api.joinopenfile.com/v1/applications/$ID \
  -H "Authorization: Bearer $TOKEN"
```

Over MCP, pass it as the tool's `token` input.

| Token | Where it comes from | What it opens |
| --- | --- | --- |
| Formation | `token` on the create response | That formation |
| Order | `order.token` once signed, or `k` in the owner's order link | That order |
| Application | `token` on the create response | That application |
| Filing | `filing.token` once signed, or `k` in the customer's status link | That filing |

A wrong token gets the same `404` as a wrong id.

Tokens can't be reset, so treat them like passwords. `review_url` and `status_url` contain them, so send those only to the owner.