# Authentication — SendMyCall

## Public API: no authentication

The SendMyCall public API (https://sendmycall.com/api/v1) is read-only and open: no account, no API key, no token. Send plain `GET` requests; do not send an `Authorization` header. It is described in https://sendmycall.com/openapi.json (`security: []`) and documented at https://sendmycall.com/developers.

It returns countries, number areas and their monthly prices, and calling and forwarding rates. Each client IP address may make 60 requests per 60 seconds; the `RateLimit` and `X-RateLimit-*` headers report what is left, and a `429` carries `Retry-After`.

## MCP server: no authentication

The SendMyCall MCP server (https://sendmycall.com/api/mcp, Streamable HTTP, stateless) serves the same read-only data as tools and needs no authentication either: connect without credentials. Its server card is https://sendmycall.com/api/mcp/server-card. It has the same limit as the API, counted on its own.

The machine-readable files of the site (https://sendmycall.com/llms.txt, https://sendmycall.com/.well-known/api-catalog, the agent skills) need no authentication either.

## Accounts: people only, for now

Buying a number and managing an account (numbers, forwarding, balance, calls and texts) are done by the account holder on https://sendmycall.com/ and in the SendMyCall apps, after signing in. That sign-in is for people: there is no OAuth authorization server, no API key and no delegated access an agent could use on a user's behalf yet. An agent can find a number and its price with the public API and give the user the number picker link (`order_url`); the user signs up and pays.

Questions: care@sendmycall.com.