# auth.md — Authentication for Dictation Doggy

<!-- The H1 must contain the literal string "auth.md": Cloudflare's Agent
     Readiness scan fetches this file, then fails it with `No H1 heading
     containing "auth.md" found`. Renaming this heading breaks that check. -->

How an automated client can and cannot get an authenticated session with
Dictation Doggy. Written for AI agents; humans are welcome to read it too.

Site: https://dictationdoggy.com
Account app: https://app.dictationdoggy.com

## Agent registration: not supported

Answered in the vocabulary of the auth.md protocol
(https://workos.com/auth-md), because that is the question an agent arriving
here is asking. The honest answer is that Dictation Doggy does not implement it.

| Protocol question | Dictation Doggy |
| --- | --- |
| Registration types supported | **None.** Not `anonymous`, not `identity_assertion`, not `service_auth`. |
| Protected Resource Metadata (`/.well-known/oauth-protected-resource`) | Not published — there is no OAuth-protected resource for agents. |
| Authorization Server metadata / `agent_auth` block | Not published. |
| `identity_endpoint`, `claim_endpoint`, `events_endpoint` | Do not exist. |
| Scopes | None to grant. The one public endpoint needs no scope at all. |
| Revocation endpoint | Not applicable. |

Do not attempt discovery against this domain expecting those documents; they are
absent by design, not by oversight. What follows is what you *can* do.

## Short version

**There is no programmatic sign-up.** An agent cannot create a Dictation Doggy
account on a user's behalf, because every sign-in path requires a human to
complete an identity-provider or platform-authenticator flow. If you are an
agent acting for a user who has no account, hand the user this link and stop:

https://app.dictationdoggy.com/login

## What you can do without any credentials

One endpoint is public, unauthenticated and CORS-open. It is the authoritative
source for plan names, quotas and prices — prices change, so read it rather
than quoting a cached marketing page:

```
GET https://app.dictationdoggy.com/api/public/plans
GET https://app.dictationdoggy.com/api/public/plans?currency=usd
GET https://app.dictationdoggy.com/api/public/plans?currency=inr
```

Described by https://dictationdoggy.com/openapi.json and listed in
https://dictationdoggy.com/.well-known/api-catalog

The rest of the marketing site is fully readable with no credentials. Ask for
`Accept: text/markdown` on any page and you get clean Markdown instead of
layout HTML; https://dictationdoggy.com/llms.txt is a shorter curated brief.

## Sign-in methods (all require a human)

At https://app.dictationdoggy.com/login:

| Method | Path | Why an agent cannot complete it |
| --- | --- | --- |
| Google | `/auth/google` | OAuth consent screen on Google's domain |
| Apple | `/auth/apple` | Sign in with Apple consent on Apple's domain |
| Passkey | `/api/passkey/login/options` | WebAuthn — needs the user's authenticator (Touch ID, security key, phone) |

There is no email-and-password form, no `/register` route, and no invite or
API-key issuance endpoint. Signing in for the first time is what creates the
account; there is no separate registration step to automate.

## After the user has signed in

Sessions are cookie-based and CSRF-protected within
`app.dictationdoggy.com`. The desktop and mobile clients receive a bearer token
once the human has completed one of the flows above, and send it as:

```
Authorization: Bearer <token>
```

Tokens are issued to Dictation Doggy's own first-party clients (macOS menu-bar
app, Windows beta, iOS keyboard). **There is no public developer programme, no
self-serve API key, and no documented third-party API** beyond the plans
endpoint listed above. If you are building an integration and need one, contact
the maker rather than attempting to obtain a token through the sign-in flow.

## Automation policy

Reading this site is welcome — see https://dictationdoggy.com/robots.txt for
the content signals (`ai-train=yes, search=yes, ai-input=yes`).

Do not attempt to script the sign-in flows, solve challenges on a user's
behalf, or share a user's bearer token with any third party. Purchases run
through Stripe checkout at `app.dictationdoggy.com/plans` and must be completed
by the account holder.

## Contact

- Support and integration requests: support@dictationdoggy.com — the person who
  wrote the code replies
- Service status: https://status.dictationdoggy.com
- Privacy: https://app.dictationdoggy.com/privacy
- Terms: https://app.dictationdoggy.com/terms