# MyDotCheck authentication for agents (auth.md)

> MyDotCheck has no authentication. The public API, the MCP server and the NLWeb /ask endpoint are free, read-only and open to any agent without credentials.

## Audience

AI agents, MCP clients and scripts that read DOT compliance data for U.S. trucking companies.

## Discover

- Developer guide: https://mydotcheck.com/developers
- OpenAPI 3.1 spec: https://mydotcheck.com/openapi.json
- API catalog (RFC 9727): https://mydotcheck.com/.well-known/api-catalog
- MCP server (Streamable HTTP): https://mydotcheck.com/mcp, card at https://mydotcheck.com/mcp/server-card
- Agentic resource catalog: https://mydotcheck.com/.well-known/ard.json

## Pick a method

There is one method: anonymous access. No API key, OAuth token, agent_auth registration, identity_assertion or service_auth exchange is offered or required, so there is no identity_endpoint, no token endpoint and no WWW-Authenticate challenge. Requests never return 401.

## Register

Not required. There is nothing to register or claim.

## Use

Call the endpoints directly:

```
curl https://mydotcheck.com/api/v1/carriers/80806
curl "https://mydotcheck.com/api/v1/carriers?q=swift%20transportation"
curl "https://mydotcheck.com/api/v1/ucr-fee?vehicles=4"
```

## Rate limits

60 requests per minute per IP. Every response carries `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` and `RateLimit-Policy`. A `429` includes `Retry-After` in seconds.

## Errors

JSON body `{"error":{"code","message"}}` with codes `invalid_dot_number`, `invalid_mc_number`, `invalid_query`, `invalid_vehicles`, `invalid_year` (400), `not_found` (404), `rate_limited` (429) and `upstream_unavailable` (503, retry later).

## Revocation

Nothing to revoke: no credentials are issued.

## Sign-ups for people

The email alert sign-up on https://mydotcheck.com/#alerts is for humans and only takes an email and a USDOT number. Agents should not submit it on a user's behalf without explicit consent.