# PubFi authentication and payment lanes

> Choose one lane for each request. PubFi rejects conflicting credentials and does not fall back from one lane to another.

- Public catalog and capability reads require no authentication.
- Registered HTTP execution uses a PubFi API key. Protected hosted MCP tools accept one PubFi API key or one valid PubFi MCP OAuth access token.
- Account-bound :free routes still require an admitted account credential and charge zero Credits.
- Accountless x402 uses the explicit x402 endpoint and rejects Bearer credentials.
- Provider credentials, account billing state, and payment material stay server-side.

## Access paths

### Public discovery and contracts

- Cost: No account.
- Authentication: No authentication is required for these read-only public resources.
- Purpose: Read Discovery, the complete Registry capability catalog, exact capability detail, Runtime OpenAPI, and public MCP catalog tools.
- Use this lane to find sources and inspect current executable contracts.
- Public catalog access does not authorize route execution.
- The live Registry, not checked-in marketing content, owns readiness.
- Next: [Open Developers](https://pubfi.ai/developers).

### Registered account

- Cost: Credits or account-bound :free.
- Authentication: The selected credential must resolve to an admitted billing account. Exact :free variants remain account-bound and charge no Credit.
- Purpose: Use a PubFi API key for HTTP execution or a PubFi API key or Supabase OAuth access token for protected hosted MCP tools.
- Eligible billing accounts receive one lifetime starter grant of 1,000 Credits. Each starter allocation is valid for 365 days.
- The current checked-in catalog defines 1,000 Credits for USD 1.00, valid for 365 days.
- A purchase is available only when the authenticated billing response returns the exact current offer. Per-operation Credit cost comes from the live Registry.
- Next: [Open app](https://pubfi.ai/login).

### Accountless x402

- Cost: Exact live route quote.
- Authentication: Do not send a Bearer credential. The unsigned request receives an exact payment challenge, and the signed retry uses the environment-matched x402 lane.
- Purpose: Use the explicit HTTP or MCP x402 endpoint for a route that the live Registry currently enables for accountless payment.
- The live Registry, signed offer, pay-to address, asset, network, and payment challenge are authoritative.
- x402 consumes no account Credits and creates no PubFi account, invoice, API key, or anonymous dashboard.
- A published route can be unavailable, free, account-priced, or x402-priced. Do not infer a payment path from Discovery content.
- Next: [Read the x402 guide](https://docs.pubfi.ai/getting-started/x402).

### Custom delivery

- Cost: Custom terms.
- Authentication: Access, commercial terms, and delivery boundaries are confirmed in writing for the selected program.
- Purpose: Use a separately scoped delivery when a production program needs custom source integration, data packaging, service levels, or support.
- Custom delivery does not make every indexed provider executable.
- Source rights, credentials, route contracts, and acceptance stay explicit.
- Contact PubFi with the workflow, data scope, and expected delivery requirements.
- Next: [Discuss custom delivery](mailto:hello@pubfi.ai?subject=PubFi%20custom%20delivery).


## Runtime authority

- [Capability catalog](https://api.pubfi.ai/v1/capabilities)
- [Runtime OpenAPI](https://pubfi.ai/openapi.json)
- [Hosted MCP manifest](https://pubfi.ai/.well-known/mcp.json)