# Agent Tollgate auth.md

## Audience
Autonomous AI agents and their operators calling the pay-per-call tools at https://skinwinking.com.

## Registration
None. There are no accounts, API keys or OAuth clients to provision. The paying wallet is the identity.

## Supported methods
- **x402 (HTTP 402 Payment Required)**: call any route under https://skinwinking.com/api/v1 without payment, read the 402 response (`PAYMENT-REQUIRED` header and JSON body: network, asset, amount, payTo), pay in USDC on Base, Polygon or Solana, and repeat the request with the payment in `PAYMENT-SIGNATURE` (x402 v2), `X-PAYMENT` (v1) or `Authorization: Bearer <tx hash or signature>`.
- **MCP**: POST https://skinwinking.com/mcp (Streamable HTTP, JSON-RPC). Paid tools accept a `paymentProof` argument.

## Credential use
Each payment authorises exactly one request and is rejected if reused or older than 15 minutes. Nothing is stored between calls.

## Discovery
- Tools and prices: https://skinwinking.com/llms.txt, https://skinwinking.com/openapi.json, https://skinwinking.com/.well-known/x402
- Agent card: https://skinwinking.com/.well-known/agent-card.json
- Contact: support@skinwinking.com