---
title: HostDirect authentication and public access
canonical: https://hostdirect.nl/auth.md
---

# Authentication

## Overview
HostDirect's catalogue and MCP tools are public and read-only. Authentication: none. No account, signup, API key, OAuth, payment or credentials are required. Do not send passwords, personal customer data or hosting credentials. This document explains anonymous access; it does not advertise an agent registration protocol.

## Quick start
Send GET https://hostdirect.nl/api/catalog without an Authorization header. HTTP 200 returns JSON with providers and public pages. Read https://hostdirect.nl/docs/ and https://hostdirect.nl/openapi.json for the complete contract.

```sh
curl --fail --show-error -H 'Accept: application/json' https://hostdirect.nl/api/catalog
```

For MCP, initialize https://hostdirect.nl/mcp using Streamable HTTP, then use search_providers, get_provider or compare_providers. All tools read the same public catalogue. No client registration or token exchange is needed.

## Permissions
Only public hosting, email and storage comparisons, original price dates and public sources can be read. Purchasing, sending messages, changing DNS, accessing accounts and private data are unsupported. WordPress administrator authentication is separate and is not an agent integration. GET/HEAD and the read-only MCP tools are safe to repeat; no Idempotency-Key is required because they perform no writes.

## Errors and recovery
For 400 correct limit/offset, for 404 check the URL, and for 405 use GET/HEAD for REST or POST for MCP. REST application errors return application/problem+json with type, title, status, detail plus the backwards-compatible code, message, data and documentation fields. Respect Retry-After on temporary errors, retry at most twice, then report failure. Hosting/proxy failures may return HTML; check HTTP status and Content-Type before decoding. REST and MCP share 120 requests per connection IP per fixed minute. Read RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. There is no token refresh or credential acquisition flow. Contact: https://hostdirect.nl/contact/.