# Fitexo auth.md

How AI agents and other automated clients get access to Fitexo.

## Audience

This document is for AI agents, crawlers, assistants and integration scripts
acting for a user or on their own. People should use https://fitexo.in.

## Public website API: no registration needed

The read-only public API needs no account, key or token.

- Base URL: https://fitexo.in/api/v1
- OpenAPI description: https://fitexo.in/openapi.json
- API catalog (RFC 9727): https://fitexo.in/.well-known/api-catalog
- Endpoints: `GET /pricing`, `GET /faq`, `GET /health`

Send requests without an `Authorization` header. Responses are public and cacheable.

## Website content

Every page can be fetched as Markdown by sending `Accept: text/markdown`.
Summaries for language models are at https://fitexo.in/llms.txt and https://fitexo.in/llms-full.txt.
Usage preferences are declared as Content Signals in https://fitexo.in/robots.txt
(search=yes, ai-input=yes, ai-train=no).

## Gym account data and the Messaging API: provisioned credentials

Fitexo does not offer self-service agent registration or OAuth.
Access to a gym's account data or to the Cloud Messaging API is provisioned manually
for the gym that owns the data.

- Supported method: manual provisioning of an API key for an existing Fitexo customer.
- How to request: the gym owner emails support@fitexo.in from the account's registered
  email address, naming the integration and the access it needs.
- Using the credential: send it as a bearer token in the request header,
  `Authorization: Bearer <api-key>`. Never put it in a URL or query string.
- Revocation: the gym owner can ask support@fitexo.in to revoke a key at any time.

Agents must not try to create Fitexo accounts, start trials or submit lead forms
without the explicit instruction of the person they act for.

## Contact

- Support: support@fitexo.in
- Security issues: https://fitexo.in/.well-known/security.txt