# Authentication and authorization

Public REST and MCP reads need no credentials and remain rate limited. Start at https://mybitcoinexplorer.com/developers.md.

Private account data and reports require authentication, ownership checks and scopes. Account holders manage their own tracing keys in the dashboard. Credentials must never be copied into a public document or shared with other users.

There is no agent OAuth authorization server. Google sign-in is a human account login, not an agent delegation endpoint. Do not request seed phrases, private keys, passwords or wallet transaction signatures. A login message does not authorize a purchase or payment.

Use only the access explicitly granted by the user. Do not expose private reports through public MCP or discovery metadata.