# Auth.md — DataFeeds authentication

## Agent audience

Agents integrating with Rolling Insights DataFeeds REST or MCP APIs need an `RSC_token` issued through the documented human account and dashboard flow. Agents helping users with SportWise should guide human account holders through the SportWise browser registration flow. This host publishes discovery metadata only; credential issuance and product access happen through the account and product flows below.

## Agent boundaries

An agent may explain or guide a human account holder through registration, but must never collect, store, or transmit passwords, payment details, or API tokens. Direct the account holder to the public browser registration page for each product and let them complete signup themselves.

There is no `POST /agent/auth` registration endpoint, no OAuth/OIDC discovery endpoint, and no machine registration endpoint on rolling-insights.com.

## Agent registration

Registration methods supported:

- `account_provisioning`: a human account holder creates a trial or paid account through the product registration URLs below. This is human-in-the-loop registration; rolling-insights.com does not expose a machine registration endpoint.

Machine-readable summary (Auth.md agent_auth metadata):

```json
{
  "agent_auth": {
    "skill": "https://rolling-insights.com/auth.md",
    "register_uri": null,
    "provisioning": {
      "datafeeds_account_setup": "https://accounts.rolling-insights.com/register",
      "datafeeds_agent_setup_guide": "https://docs.datafeeds.rolling-insights.com/agent-setup/#pick-your-agent",
      "sportwise_account_setup": "https://sportwise.rolling-insights.com/register"
    }
  }
}
```

## DataFeeds account and API-key provisioning

1. Direct the account holder to https://accounts.rolling-insights.com/register in a browser.
2. Each new account begins with a 30-day trial API key through the documented account flow.
3. After registration, the account holder retrieves `RSC_token` (REST) or configures `RSC_TOKEN` (MCP) from the DataFeeds dashboard and official agent setup guide at https://docs.datafeeds.rolling-insights.com/agent-setup/#pick-your-agent.
4. The agent must not handle credentials on the account holder's behalf.

## SportWise account provisioning

1. Direct the account holder to https://sportwise.rolling-insights.com/register in a browser.
2. The account holder creates a SportWise account and then accesses the SportWise app at https://sportwise.rolling-insights.com/.
3. The agent must not handle login credentials or payment details on the account holder's behalf.

## Authentication methods

DataFeeds REST clients use the `RSC_token` described in the official API documentation. DataFeeds MCP clients use the `RSC_TOKEN` environment variable described in the official agent setup guide. Obtain credentials through the documented DataFeeds setup and trial flows; never place a token in source control, public URLs, browser code, or prompts.

Rolling Insights does not advertise OAuth, dynamic client registration, token exchange, revocation, or identity-provider metadata through this document. If those capabilities become available, they require a separately reviewed metadata update.

- API documentation: https://docs.datafeeds.rolling-insights.com/
- Agent setup: https://docs.datafeeds.rolling-insights.com/agent-setup/#pick-your-agent
- DataFeeds trial and account registration: https://accounts.rolling-insights.com/register
- SportWise account registration: https://sportwise.rolling-insights.com/register
- SportWise app access: https://sportwise.rolling-insights.com/