# Auth.md

Authentication at Drop Peptides

Public research guides, Markdown documents, and GET /api/catalog require no authentication. They expose no private customer records.

## Human accounts

A person can create an account at https://droppeptides.com/signup or sign in at https://droppeptides.com/signin. These pages use first-party session cookies. Users must acknowledge the research-only purpose.

## Agent boundary

No OAuth provider, delegated login, service account, password-sharing workflow, or autonomous registration is provided. Do not collect a user's password or reuse their session cookie. Hand off account activity to the person in their browser. Private APIs require the person's valid session and same-origin requests.

## Checkout

Live checkout is disabled. No agent may represent a saved bag as an order, infer inventory, or simulate payment success. Public discovery tools are read-only.