# Long Thanh Imbiss — Authentication and public access

Long Thanh Imbiss in Meißen publishes anonymous, read-only menu and business
information. No account, registration, API key or access_token is required.
This guide follows the section order of [WorkOS auth.md](https://github.com/workos/auth.md).
Its registration and token protocol is **not implemented** by this public service;
unauthenticated reads differ from WorkOS anonymous credential issuance.

## Discover

- [Developer portal](https://longthanh-imbiss.com/developers/)
- [OpenAPI 3.1](https://longthanh-imbiss.com/openapi.json)
- [API catalog](https://longthanh-imbiss.com/.well-known/api-catalog)
- [Agent homepage](https://longthanh-imbiss.com/?mode=agent)
- [Markdown homepage](https://longthanh-imbiss.com/index.md)
- [MCP server card](https://longthanh-imbiss.com/mcp/server-card)
- [Agent information](https://longthanh-imbiss.com/llms.txt)

There is no OAuth authorization server or protected-resource metadata. No
agent_auth block or identity_endpoint is advertised. Public requests do not
receive a WWW-Authenticate challenge because these resources are unprotected.

## Pick a method

Use unauthenticated GET or HEAD on `/api/v1/menu?language=de` (de, en, zh, vi),
`/api/v1/business`, or `/speisekarte.txt`. Connect an MCP client to
`https://longthanh-imbiss.com/mcp` using Streamable HTTP (POST, JSON-RPC).
The fetch tools `get_menu` and `get_business_info` take `{}` arguments.
The read-only `search_menu` tool requires `query`; optional `language` is de, en, zh
or vi and `limit` is 1–20 (default 10). Discover all schemas with tools/list.

Do not send Authorization headers, passwords, email addresses or identity
assertions. WorkOS identity_assertion, id-jag and service_auth methods,
including its anonymous registration method, are unsupported here.

## Register

Not applicable. There is no registration or credential provisioning endpoint.
Do not POST to an assumed identity_endpoint or `/agent/identity`.

## Claim

Not applicable. There are no agent registrations to claim, claim tokens,
verification codes or claim ceremony. No user identity is collected by the API.

## Exchange

Not applicable. No identity_assertion is issued or accepted, and there is no
token_endpoint, JWT exchange, OAuth grant or refresh token.

## Use the access_token

Not applicable. This service issues no access_token. Read public information directly:

```sh
curl 'https://longthanh-imbiss.com/api/v1/menu?language=en'
curl 'https://longthanh-imbiss.com/api/v1/business'
```

Cache facts for at least five minutes. These services cannot place orders,
reserve tables, take payment or confirm live availability or allergen safety.
Confirm those by telephone at +49 3521 40 61 80.

## Errors

REST errors use application/problem+json with HTTP status, code, detail and
resolution. Invalid query: 400; missing resource: 404; unsupported method: 405;
quota exceeded: 429; temporary failure: 503. Correct a 4xx request before retrying;
back off on a 5xx. Both v1 endpoints share 60 requests per client IP per
60-second window. Inspect RateLimit and RateLimit-Policy; honor Retry-After on 429.

MCP unknown tools and invalid arguments return JSON-RPC error code -32602 with a
message and the original request ID. Unknown RPC methods use -32601. Discover
valid names and inputs with tools/list. HTTP transport failures use problem details.

See [API documentation](https://longthanh-imbiss.com/api/) and the
[versioning policy](https://longthanh-imbiss.com/api/deprecation/).

## Revocation

Not applicable. No credentials, tokens or delegated registrations exist to
revoke. There is no revocation_endpoint or agent_auth events endpoint. Stop
making requests to end use of the public service. Respect published
[robots.txt](https://longthanh-imbiss.com/robots.txt) preferences.

The [Web Bot Auth public-key directory](https://longthanh-imbiss.com/.well-known/http-message-signatures-directory)
identifies this site's outbound signer. It does not confer API permissions or
verify arbitrary incoming bots; their signatures require their own trusted keys.