# Starlecta auth.md You are an agent. This file explains how access to Starlecta works today. Agents can register with Starlecta for an API key to its public tools (see Registration). OAuth is not used, so no authorization-server or protected-resource metadata is published. Public pages need no credentials at all. ## Registration - Agent audience: AI agents and assistants working for a person who needs Starlecta's public creator data (lookup, compare, search, AI search, Trend Cloud). - Registration endpoint: POST https://starlecta.com/api/agent/keys with a JSON body {"label", "email", "use"}. The agent registers itself; no account and no browser check. - Method: self-registration for an API key; a person can use the form instead: https://starlecta.com/en/agents/key. - Credential: an API key that starts with `slk_`, shown once in the answer. - Credential use: `Authorization: Bearer slk_...` on the MCP server https://starlecta.com/mcp and on https://starlecta.com/api/agent/tools/... (details below). - Revocation: write to support@starlecta.com; a revoked or wrong key answers `401` with `{"error":"invalid_key"}`. ## Who this is for - Agents reading Starlecta's public website for a person: search, answers, research. - Agents working for a person at a Starlecta customer (a brand or an agency). ## Public content: no credentials needed Everything below is public and read-only. It needs no account, key or header. - Page index: https://starlecta.com/llms.txt (English), https://starlecta.com/tr/llms.txt (Turkish) - Markdown of public pages: add `.md` to a page address, or request the page with `Accept: text/markdown` - Sitemap: https://starlecta.com/sitemap.xml - How to read and cite Starlecta pages: https://starlecta.com/.well-known/agent-skills/index.json - Machine-readable list of these interfaces: https://starlecta.com/.well-known/api-catalog - Open examples and a read-only MCP server that runs on your own machine over a synthetic sample edition: https://github.com/Starlecta/starlecta-examples Content use is stated in https://starlecta.com/robots.txt (`Content-Signal`). Cite the page address and the date line shown next to each figure. The interactive demo on the website is for people in a browser. Do not automate the browser: use an agent key (below). ## Agent key for the public tools Starlecta issues agent keys for its four public tools (lookup, compare, search and AI search). A key replaces the browser security check and has limits of its own, separate from visitors. The answers are the same as on the website. Get a key (an agent can do this itself, once): - POST https://starlecta.com/api/agent/keys with a JSON body {"label": "", "email": "", "use": ""}. No browser check is needed. The answer holds the key once; Starlecta keeps only a hash and cannot show it again. - A person can use the form instead: https://starlecta.com/en/agents/key (Turkish: https://starlecta.com/tr/ajanlar/anahtar). - Keys per address and per day are limited; ask for one key and reuse it. - A key starts with `slk_`. Keep it secret: do not put it in a page, a public repository or a prompt that others can read. Use it over MCP (recommended for agents): - Streamable HTTP MCP server: https://starlecta.com/mcp (stateless, JSON responses). Tools: lookup_influencer, compare_influencers, search_influencers, ai_search_influencers, trend_cloud. - Send `Authorization: Bearer slk_...` on the MCP requests. trend_cloud (hashtags, products, platforms and brands of the last 7 days) works without a key. - Discovery card: https://starlecta.com/.well-known/mcp/server-card.json (also at https://starlecta.com/.well-known/mcp.json). Or use it over plain HTTP: - Send `Authorization: Bearer slk_...` with every request. - Lookup: GET https://starlecta.com/api/agent/tools/lookup?handle= - Compare: GET https://starlecta.com/api/agent/tools/compare?a=&b= - Search: GET https://starlecta.com/api/agent/tools/search?category=&tier=&followers_min=&followers_max=&er_measured= (every filter is optional) - AI search: POST https://starlecta.com/api/agent/tools/ai-search with a JSON body {"sentence": ""}. The sentence is read as the same filters as Search (fast mode only); detailed AI search stays in the panel. - OpenAPI: https://starlecta.com/openapi/public-pages.json (bearer security scheme `agentKey`). What an answer holds: - Each handle is `open` (public follower count and measured engagement rate, dated), `tracked` (name, tier, category and a rounded follower band, no metric) or `not_listed` (no match, or an account that cannot be shown). Every other field is a locked placeholder. - Search returns a count (shown as `fewer than 10` below 10), up to two open cards and the number of locked results; it never lists tracked or locked identities. - The Starlecta Quality Score is not part of these tools for named creators. - Quote a figure together with its date and cite the page address, as for any other public data. Limits per key (launch values; the response that issues your key lists yours): - Per day: lookup 30, compare 15, search 30, AI search 10. - Per minute: 6 requests, all tools together. - A shared daily total across all agent keys also applies. It is separate from the visitor limits of the website. - `429` with `Retry-After` means a limit was reached; wait that many seconds. `401` with `{"error":"invalid_key"}` means the key is missing, wrong or revoked. `404` means that tool is switched off. Terms: - Use a key for the purpose you gave when you requested it. Do not share, resell or publish it. - Do not copy the creator catalogue, build lists in bulk or get around the limits with several keys. A key may be revoked without notice. - Your e-mail is used only to contact you about the key. To revoke a key or ask a question: support@starlecta.com - Terms of use: https://starlecta.com/en/terms. Privacy: https://starlecta.com/en/privacy. ## Customer accounts: provisioned by Starlecta, for people - Starlecta accounts are created by Starlecta for companies. There is no self-service sign-up. - To ask for access, the person you work for can use the demo request form: https://starlecta.com/en/demo-request (Turkish: https://starlecta.com/tr/demo-request), or e-mail sales@starlecta.com. - The customer panel at https://panel.starlecta.com is for signed-in people. Its sessions are short-lived and are not API credentials. - Do not ask a person for their Starlecta password, and do not sign in with it for them. - Automated or bulk access to customer data is not offered. Customer accounts have usage limits and are audited. ## Security and legal - Security contact: https://starlecta.com/.well-known/security.txt - Terms of use: https://starlecta.com/en/terms - Privacy: https://starlecta.com/en/privacy