# CukaiMax Agent Auth

Public CukaiMax discovery endpoints are read-only and do not require credentials.

Private user data, receipts, account details, and exports require explicit user authentication in the CukaiMax app. Agents must not ask users to paste private receipt data into public endpoints.

Resource metadata:
- https://www.cukaimax.com/.well-known/oauth-protected-resource
- https://www.cukaimax.com/.well-known/oauth-authorization-server