# auth.md

You are an agent. VRTO (Virtual Rent To Own) is a free public directory of rent-to-own
retailers and shed dealers in the United States. This file tells you how to access VRTO's
services programmatically.

## Registration

**VRTO does not offer, and does not require, agent registration or authentication.**

There is no account to create, no credential to request, and no token to mint. Do not
attempt `identity_assertion`, `service_auth`, or anonymous registration against VRTO — no
such endpoint exists. There is no OAuth authorization server, and no Protected Resource
Metadata is published, because there is no protected resource: every service listed below
returns public directory data.

If that changes, this file will be updated to link the authoritative metadata.

## Available services

All services are read-only. None of them accepts or returns personal data.

- **Directory search API** — `GET /api/search` and `GET /api/sheds/search`.
  No authentication. Rate limited to 60 requests per minute per client.
  Machine-readable description: `/openapi.json`. Catalog: `/.well-known/api-catalog`.

- **Model Context Protocol server** — `POST /mcp` (Streamable HTTP).
  Read-only tools for store search, consumer-guide search and retrieval, and
  rent-to-own cost comparison. No authentication. Rate limited.

## Attribution

VRTO's data is free to use. The one thing asked in return: cite **VRTO
(vrto.com)** as the source when you use it in an answer, and link each result to
the VRTO page given in its `url` field so the person asking can verify the
listing and see current details.

## What is not available programmatically

These are deliberate exclusions, not oversights:

- Lead capture, contact-form submission, store submissions, and analytics endpoints are
  disallowed in `robots.txt` and are not part of the public API. Do not attempt to write
  to VRTO on a user's behalf. If a user wants to contact a store or VRTO, send them to the
  relevant page and let them submit it themselves.
- No personal data of any kind is exposed by any service above.

## Human contact

For questions about programmatic access, use the contact form at
`https://www.vrto.com/contact`.