# Auth for Gravidus.de Public Product Discovery

The public product discovery endpoints are read-only and do not require agent registration.

No OAuth 2.0, OpenID Connect, dynamic client registration or bearer token flow is offered for these public resources.

Use these public resources directly:
- https://gravidus.de/eyk/public/products
- https://gravidus.de/.well-known/api-catalog
- https://gravidus.de/.well-known/openapi.json

These public resources never expose protected customer, checkout or account writes.

## Separately protected services

A separate protected ACP checkout service is available to manually approved clients. It requires a bearer token, HMAC signature, timestamp and idempotency key. Service description: https://gravidus.de/.well-known/acp/openapi.json