---
resource: https://collabstr.com
authorization_servers:
- https://collabstr.com
scopes_supported:
- public
- read
- write
bearer_methods_supported:
- header
agent_auth:
  skill: https://collabstr.com/auth.md
  register_uri: mailto:support@collabstr.com?subject=Agent%20Integration%20Request
  registration_methods:
  - type: email
    uri: mailto:support@collabstr.com?subject=Agent%20Integration%20Request
    identity_type: service_account
    credential_type: api_key
  identity_types_supported:
  - service_account
  credential_types_supported:
  - api_key
  claim_documentation_uri: https://collabstr.com/auth.md
  revocation_documentation_uri: https://collabstr.com/auth.md
  identity_endpoint: https://collabstr.com/agent/identity
  claim_endpoint: https://collabstr.com/agent/identity/claim
  events_endpoint: https://collabstr.com/agent/event/notify
  identity_assertion:
    assertion_types_supported:
    - urn:ietf:params:oauth:token-type:id-jag
    - verified_email
  events_supported:
  - https://schemas.workos.com/events/agent/auth/identity/assertion/revoked
---

# auth.md

```agent_auth
{
  "skill": "https://collabstr.com/auth.md",
  "register_uri": "mailto:support@collabstr.com?subject=Agent%20Integration%20Request",
  "registration_methods": [
    {
      "type": "email",
      "uri": "mailto:support@collabstr.com?subject=Agent%20Integration%20Request",
      "identity_type": "service_account",
      "credential_type": "api_key"
    }
  ],
  "identity_types_supported": [
    "service_account"
  ],
  "credential_types_supported": [
    "api_key"
  ],
  "claim_documentation_uri": "https://collabstr.com/auth.md",
  "revocation_documentation_uri": "https://collabstr.com/auth.md",
  "identity_endpoint": "https://collabstr.com/agent/identity",
  "claim_endpoint": "https://collabstr.com/agent/identity/claim",
  "events_endpoint": "https://collabstr.com/agent/event/notify",
  "identity_assertion": {
    "assertion_types_supported": [
      "urn:ietf:params:oauth:token-type:id-jag",
      "verified_email"
    ]
  },
  "events_supported": [
    "https://schemas.workos.com/events/agent/auth/identity/assertion/revoked"
  ]
}
```

Collabstr — Agent Authentication Policy. Public read-only surface for agents and LLMs. Most discovery is unauthenticated. Programmatic write access requires agent registration.

## Public (no auth)

Crawlable without credentials, subject to rate limits in `/robots.txt`:

- Creator profiles: `https://collabstr.com/{username}`
- Top creators by niche: `https://collabstr.com/top-influencers/{niche}`
- Blog posts: `https://collabstr.com/blog/{slug}`
- LLM indexes: `https://collabstr.com/llms.txt`, `https://collabstr.com/llms-full.txt`
- Sitemap: `https://collabstr.com/sitemap.xml`
- Free tools (engagement calculators, pricing calculators, etc.)
- Research reports (e.g. `https://collabstr.com/2026-influencer-marketing-report`)

These endpoints serve HTML/Markdown/XML and may be crawled within the rules in `https://collabstr.com/robots.txt`.

## agent_auth

The canonical `agent_auth` metadata for Collabstr is published as JSON inside `/.well-known/oauth-authorization-server` (`agent_auth` key). The same fields are summarized below in human-readable form.

```json
{
  "register_uri": "mailto:support@collabstr.com?subject=Agent%20Integration%20Request",
  "identity_types_supported": ["service_account"],
  "credential_types_supported": ["api_key"],
  "claim_documentation_uri": "https://collabstr.com/auth.md",
  "revocation_documentation_uri": "https://collabstr.com/auth.md"
}
```

## Agent Registration

Agents that need programmatic access beyond public crawling must register.

### How to register

1. Email `support@collabstr.com` with subject `Agent Integration Request`.
2. Include:
   - Agent operator (org name, contact email)
   - Use case (read-only data sync / hiring automation / analytics / other)
   - Identity type — `service_account` is the only supported identity type today
   - Credential type — `api_key` (issued out-of-band, rotated on request)
   - Expected QPS and concurrency
   - Static IP allowlist if available
3. Wait for confirmation. Turnaround: 3-5 business days.

### Register endpoint

`mailto:support@collabstr.com?subject=Agent%20Integration%20Request`

(A machine-readable registration endpoint is on the roadmap; meanwhile the `register_uri` in `/.well-known/oauth-authorization-server` points to the email gate.)

### Identity types supported

- `service_account` — long-lived agent identity, one credential per integration

### Credential types supported

- `api_key` — bearer header `X-API-Key: <key>` on each request

### Claim & revocation

- Credentials are issued via secure channel after registration is approved.
- Revoke immediately by emailing `support@collabstr.com` with subject `Revoke Agent Credential`.
- Claim documentation: this file (`/auth.md`).
- Revocation documentation: this file (`/auth.md`).

## Authenticated actions (require approved agent registration or a user session)

The following actions require an authenticated session bound to a real Collabstr user OR an approved agent credential:

- Hiring a creator / purchasing a package
- Sending messages to creators
- Posting a campaign
- Submitting applications
- Withdrawing funds
- Billing / subscription management

**Without explicit agent registration, agents must not attempt these actions on a user's behalf.** Redirect the user to the corresponding URL on `https://collabstr.com` so they can complete the flow in their own browser session.

## Authentication mechanisms

- **Session cookies** (web flow, Django session middleware) — for human browser users
- **DRF Token** (`Authorization: Bearer <token>`) — for mobile clients and first-party integrations
- **API key** (`X-API-Key: <key>`) — for registered agents and trusted server-to-server integrations

No public OAuth flow exists today. The `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource` documents are published for discovery; their `register_uri` points at the email gate above.

## Rate limiting

Per-IP rate limiting is enforced on all endpoints. Unauthenticated requests are limited to roughly 60 requests/minute per IP. Excess traffic returns `429 Too Many Requests`.

Crawlers should respect:

- `Crawl-delay` directives in `robots.txt` (none currently set; site is permissive)
- `429` responses with `Retry-After`
- `Cache-Control` headers — much of the public content is cached for 24h, so re-fetching does not require re-crawling

## Contact

- Integration inquiries: `support@collabstr.com`
- Terms: `https://collabstr.com/terms`
- Privacy: `https://collabstr.com/privacy`

## Related discovery files

- `https://collabstr.com/robots.txt`
- `https://collabstr.com/llms.txt`
- `https://collabstr.com/llms-full.txt`
- `https://collabstr.com/.well-known/mcp.json`
- `https://collabstr.com/.well-known/ai-plugin.json`
- `https://collabstr.com/.well-known/agent-card.json`
- `https://collabstr.com/.well-known/openid-configuration`
- `https://collabstr.com/.well-known/oauth-authorization-server`
- `https://collabstr.com/.well-known/oauth-protected-resource`
- `https://collabstr.com/.well-known/agent-skills/index.json`