# BUFI authentication documentation — bu.finance

## Public reading endpoints

The BUFI landing website's public pages and reading resources require no authentication. Send no API keys, access tokens, wallet credentials or personal data to them.

| Resource | Authentication | Format |
| --- | --- | --- |
| / and locale homepage URLs | None | HTML or English Markdown via Accept |
| /docs | None | HTML or Markdown via Accept |
| /openapi.json | None | OpenAPI 3.1 JSON |
| /index.md, /docs.md, /auth.md | None | Markdown |
| /blog/<slug>.md | None | Published blog Markdown |
| /llms.txt, /llms-full.txt | None | Plain-text Markdown documents |
| /robots.txt | None | Crawler directives |
| /sitemap.xml, /blog/rss.xml | None | XML |

The [BUFI OpenAPI specification](https://www.bu.finance/openapi.json) catalogs this public read-only surface. The [BUFI developer documentation](https://www.bu.finance/docs) explains negotiation and integration boundaries.

## Protected browser helpers

The landing has browser helpers under /api for chat, sales inquiries, stickers and its bonus game. They are not a public product integration API. Their existing same-origin checks, bot verification, signed cookies, rate limits and capability checks vary by endpoint. Public reading access does not bypass these protections or authorize a submission.

## The BUFI product

The financial workspace is separately hosted at https://desk.bu.finance. Product credentials, onboarding, workspace permissions and human approval requirements belong to that application. This landing does not issue product API keys, OAuth clients or machine credentials, and it does not host a network MCP server.

Do not infer an integration authentication contract from the landing's anonymous reading endpoints. Contact [BUFI](mailto:hello@bu.finance) to confirm the supported product interface and access requirements for your use case.