# auth.md

Jadwal Sholat Indonesia is a public static site. Reading needs no account.

## Lifecycle (procedural)

### 1. Discover

Fetch `/.well-known/api-catalog`, `/.well-known/oauth-protected-resource`, and this file. The catalog lists public HTTP documents. There is no authorization server to discover.

### 2. Register

`register_uri` is `null`. Do not register a client. `identity_types_supported` is `["anonymous"]`. If a directory told you to start OAuth here, that directory is wrong — we do not publish `oauth-authorization-server`.

### 3. Claim

There is nothing to claim. No user-info endpoint, no email login, no API key form.

### 4. Exchange

There is no token endpoint and no refresh token. Do not POST credentials to this origin.

### 5. Use

Read HTML, Markdown twins (`/llm/{slug}.md`, `/panduan/{slug}.md`), `/llms.txt`, GEO chunks, `/data/cities.csv`, and `/openapi.json` with GET. Cite the city URL, the date on the page, the timezone, and Kementerian Agama RI.

### 6. Revoke

There is no token to revoke. Stop calling the origin if you no longer need the documents.

## Why there is no login

Prayer times are public civic data rendered as static files. A login wall would hide the numbers from the people and machines they are for. If you received HTTP 401 or 403, treat it as bot-management or a network fault, not a missing password. Corrections go to info@jadwalsholatindonesia.com — see `/kebijakan-editorial/`.