# Authentication for nekretninenaprodaju.rs

## Choose access

- **Public MCP:** connect to `https://nekretninenaprodaju.rs/mcp` using Streamable HTTP without authentication. Initialize, then call `tools/list` for the available read-only tools. This endpoint accepts POST; GET and DELETE return 405.
- **Public REST API:** requests under `https://nekretnine-api.vercel.app/public/v1/` require an operator-issued API key in `Authorization: Bearer <your-key>`. A header-capable MCP client may use the same key for its integration quota.

There is no OAuth authorization server, dynamic client registration, authorization-code exchange or refresh-token flow for this integration. Do not attempt to discover or invent these endpoints. This document describes our actual access methods, not the WorkOS OAuth onboarding flow.

## Obtain and use a REST key

The operator issues integration keys. A human can request access through the [contact page](https://nekretninenaprodaju.rs/kontakt). There is no automated signup or key-creation endpoint. Until a key is supplied, use anonymous MCP for public listing reads. Do not send an access request on a user's behalf without their instruction.

Keep keys in a server-side secret store. Send them only to the API origin above, never in URLs, public client code, logs or listing content.

```http
GET /public/v1/locations/autocomplete?q=Beograd&countryCode=RS HTTP/1.1
Host: nekretnine-api.vercel.app
Authorization: Bearer <your-key>
```

See the [live OpenAPI specification](https://nekretninenaprodaju.rs/openapi.json) for the six public REST routes. The integration does not grant private account access, listing publication, messaging or purchasing.

## Failures, limits and revocation

HTTP 401 means the REST key is missing or invalid; do not retry it indefinitely or fabricate credentials. For HTTP 429, honor `Retry-After`. Anonymous MCP callers share a quota; keyed MCP and REST share the integration identity's quota. Current default limits and other errors are documented in the [developer guide](https://nekretninenaprodaju.rs/developers.html).

MCP tool errors can return HTTP 200 with `isError: true`; inspect the result before treating a request as successful. To revoke or rotate a key, contact the operator. Keys have no client-side refresh mechanism; an operator removes or replaces the configured key hash and deploys the change.