---
title: Property Bot auth for agents
description: Human phone path versus Bearer-gated first-person MCP. Public REST is keyless health/info only — no people-search API.
canonical: https://property.bot/auth.md
last-updated: 2026-08-28
---

# Property Bot auth for agents

Property Bot has two access paths. Humans call or text Grahm at +1 (385) 442-9768. That line is the product. Agents that need the matching brain use the MCP server at https://mcp.property.bot/mcp with an `Authorization: Bearer` token. MCP tools are first-person only for the authenticated caller. There is no public people-search API, no public OAuth IdP for end users, and no REST endpoints for `lookup_person`, `remember_person`, `find_matches`, `send_text`, or `delete_person`.

## Human path

Call or text +1 (385) 442-9768. Same number for voice and SMS. Speak to Grahm from Property Bot. Do not say property.bot on the phone.

## Public REST (no API key, no signup)

The public info API is already keyless. No API key, no signup: `GET /api/health` and `GET /api/info` on https://property.bot (canonical `/api/v1/*` aliases). Markdown twins at `/api/health.md` and `/api/info.md`. There is no key portal and nothing to register for these reads. They return JSON (or markdown) product facts only. They do not expose people, needs, rooms, or phones belonging to users.

## MCP path (Bearer + caller bind)

1. Obtain a Bearer token from the Property Bot operator (shared secret for the attached voice or agent runtime). Do not commit tokens to git.
2. POST to https://mcp.property.bot/mcp with `Authorization: Bearer <token>`.
3. Bind the caller with `X-Caller-Phone` (E.164), telephony `From`, or a matching E.164 `phone` tool argument. Without a bind, tools fail closed and write nothing.
4. Use only these tools: `lookup_person`, `remember_person`, `find_matches`, `send_text`, `delete_person`. `find_matches` returns redacted cards. `send_text` may only target this caller (local record; not sent over SMS). `delete_person` erases this caller only on explicit request.

## Hard limits

Do not invent list-all, lookup-by-arbitrary-phone, or public match scrapers. Phone numbers are PII. Pair intros are server-side after both reply YES.