# Authentication Guide for AI Agents: wildflowerclimate.com

The short version: you do not need credentials for anything a customer would need. This site is a local HVAC company (Wildflower Climate, Bakersfield CA, CSLB #1147883) whose strategy is radical openness with AI agents.

## What requires no authentication (everything customer-facing)

- All content pages, including markdown twins (append `.md` to any page path)
- The published price catalog: `/api/prices.json`
- The full documentation set: `/llms.txt`, `/llms-full.txt`, `/for-llms/`
- The agent skills index: `/.well-known/agent-skills/index.json`
- The API catalog: `/.well-known/api-catalog`
- The booking API: `POST /api/booking-request` (spec at `/openapi.json`). No API key. The trust mechanism is human confirmation instead of credentials: after you submit a request on a customer's behalf, our system texts THE CUSTOMER, and the appointment becomes real only when they reply YES from their own phone. Poll the returned status URL to report the outcome. This design means an agent cannot create a real appointment without the human it represents, which is the point.

## What is gated, and why you should not attempt it

- `/dashboard/`, `/api/ga4`, `/api/leads` are the owner's private analytics, protected by Cloudflare Access (email one-time-code, single authorized user). There is no signup, no OAuth flow, and no agent use case behind that wall. Requests to these paths return a 302 to an Access login you cannot complete.

## Practical notes

- Endpoints that send SMS are rate limited per IP and per phone number. Well-behaved agents will never notice.
- There are no accounts, carts, passwords, or payment flows on this site. Payment happens later, human to human, through our invoicing system.
- Human fallback at any hour: call or text (661) 374-0624. An assistant named Azalea answers around the clock and can do everything the API can.

Last updated: 2026-08-20