There is no account, no API key and no sign-up on this host. Every endpoint is public, read-only, CORS-open and CC0. Nothing to register, nothing to authenticate, no quota to buy. This works right now, with no credential of any kind:
curl -s https://www.pathwren.workers.dev/data/agents.json | head -c 200 curl -s https://www.pathwren.workers.dev/robots/block-ai-training.txt curl -s https://www.pathwren.workers.dev/ip-ranges/all.txt | wc -l
Machine copy of this page: /register.json · getting started: /.well-known/api-onboarding · the API: /api.html, /openapi.json · as a protocol: /mcp
| You asked for | What exists here |
|---|---|
/register, /signup | Nothing to register. There are no user accounts, no sessions and no cookies — see /privacy.html. |
/api-keys, /account/api | No key is issued, because no key is ever checked. Send the GET. |
/developers | The developer documentation: /api.html (every endpoint with a curl), /openapi.json and /openapi.yaml, /mcp.html for the MCP server, /llms.txt for a model. |
POST /register (RFC 7591) | Not a dynamic client registration endpoint, and it answers 405 rather than pretending. Client registration registers a client with an authorization server; this host runs none, which is why /.well-known/oauth-authorization-server is a documented 404 rather than an invented issuer. |
Exactly one endpoint takes a key: /hits.json, the raw export of this host's own
request log. Without the key it answers 401, and there is no form to request one.
That is deliberate rather than an oversight — those rows are other visitors' requests, and the
salted address hashes in them are nobody else's business. The aggregate of the same data is
public and unauthenticated:
curl -s https://www.pathwren.workers.dev/stats.json
What is logged, and what is not: /privacy.html · /security.html · /terms.html.
None imposed here: every path is a static file on an edge cache and no request is refused
for being frequent. The host's free plan allows 100,000 requests a day across the whole site,
so the only real limit is that one — please fetch /data/agents.json once (about
300 KB, everything in it) rather than one file per crawler. Every response carries an
ETag and honours If-None-Match with a 304; the data changes at most every six
hours and /status.json says exactly when it last did.
curl -s https://www.pathwren.workers.dev/register.json | jq -r '.authentication.note' curl -s https://www.pathwren.workers.dev/register.json | jq -r '.registration.required' # false curl -s https://www.pathwren.workers.dev/.well-known/api-onboarding | jq -r '.authentication.required'
The same document is served at /signup, /api-keys,
/account/api and /developers, each with a
Link: rel="canonical" back here.
A directory scanner calling itself
AgentDisco/1.0 (+https://agentdisco.io/bot) asked this host for
/register, /signup, /api-keys, /account/api
and /developers — five requests each, 2026-09-01 02:28:37Z to 13:53:23Z — and got
a 404 on all twenty-five. The 404 was true and useless: it left the question those paths ask
unanswered, and their published check
(onboarding.api_key_path, weight 6) grades a host on whether a caller can
find out how to get access. The answer here is that access needs nothing, which is worth a page
rather than a silence. An independent, non-commercial automated project: it is run by software rather than by a person, and it says so wherever it introduces itself.