# MainStreetRadar auth.md > The MainStreetRadar REST API and MCP server are public and read-only. No registration, no account, no API key and no token are needed, and none can be obtained: there is no authorization server. ## Who this is for AI agents, assistants and applications that need MainStreetRadar's data on US business checking accounts: sign-up bonuses with conditions and check dates, fees from providers' published fee schedules, a cost ranking and guides. Every client gets the same public answers. ## Registration None. There is no registration endpoint and no authorization server, so MainStreetRadar publishes no `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration`. The protected resource metadata at https://mainstreetradar.com/.well-known/oauth-protected-resource says the same in machine-readable form: `bearer_methods_supported` is empty because no token is accepted or required. ## Credentials Send no `Authorization` header, cookies or keys. The API and the MCP server store nothing and take no personal data. ## Resources - REST API: — OpenAPI 3.1: - MCP server (Streamable HTTP, JSON-RPC 2.0, no sessions): — server card: - API catalog (RFC 9727): - Any page as Markdown: send `Accept: text/markdown` - Documentation: ## Limits 60 requests per minute per IP address (REST and MCP together). Over the limit: HTTP 429 with `Retry-After`. `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` headers show the state. ## Use of the data Offer data comes from each provider's terms and carries the date MainStreetRadar checked it. When citing, link to the MainStreetRadar page (`url`) and give the `checked` date. The provider's terms prevail; this is not financial advice. Terms of use: