# Authentication for humans and agents

BookerPal authentication is for **humans using a web browser**.

## Humans

- Sign up and log in with email (verification codes and optional password flows) on [www.bookerpal.com](https://www.bookerpal.com/).
- Sessions use an HTTP-only `auth_token` cookie. The browser also uses a CSRF token for state-changing requests.
- Bot protection (Cloudflare Turnstile) and rate limits apply to signup, login, and guest apply flows.

## Agents and automated clients

- Do **not** use or replay a user’s session cookies.
- Do **not** attempt to complete Turnstile challenges or bypass abuse protections.
- Read public content via unauthenticated GET APIs and pages:
  - `/api/events`, `/api/projects-public`, `/api/organisations-public`, `/api/venues-public`
  - Detail routes under `/api/org/…`, `/api/projects/…`, `/api/venue/…`
  - `/sitemap.xml`, `/llms.txt`
- Applying to events, messaging, creating organisations/projects, and other write actions require a logged-in human.

## Contact

Privacy and security: privacy@bookerpal.com