Agent Discovery

OnwardTicket.us publishes the full suite of agent-readiness signals. Every protocol below is served from a /.well-known/ endpoint so AI crawlers, MCP clients, and agent frameworks can discover capabilities without out-of-band configuration.

Discovery Signals

Protocol	Description	Well-known URL	Status
Web Bot Auth	Ed25519-signed request identification per RFC 9421. Publishes a public JWK so AI agents that crawl or call OnwardTicket can prove their identity to receiving servers. The keypair thumbprint is the signing key ID in the `Signature-Input` header.	/.well-known/http-message-signatures-directory	Live
x402	Agent-native payment protocol (Coinbase x402). The stub declares our Stripe-hosted checkout as the current human-payment fallback. Native USDC on Base L2 is planned for Q3 2026 — the`facilitator` and `resources` fields will populate when it ships.	/.well-known/x402	Live (stub)
ACP Agent Capability Protocol	Service catalog and actions an agent can invoke. Declares the three booking flows (`flight-itinerary`, `hotel-reservation`, `visa-essentials`) and the actions `quote`, `lookup_order`, `place_order`. Points at the MCP SSE endpoint for structured tool access.	/.well-known/acp.json	Live
UCP User Control Protocol	User-consent and permissioned-action surface. Lists the service catalog, permitted agent capabilities (`catalog`, `quote`, `track`, `place_order`), and the canonical endpoints for each action. No OAuth token is required for the current public surface.	/.well-known/ucp	Live
MPP Model Plugin Protocol	Plugin manifest for ChatGPT and compatible plugin hosts. `/.well-known/ai-plugin.json` is the ChatGPT plugin descriptor; `/.well-known/mpp` is the MPP stub. Both point at the OpenAPI spec and the MCP transport.	/.well-known/ai-plugin.json /.well-known/mpp	Planned
MCP Server Card SEP-2127	Machine-readable descriptor of the MCP server: transport URL, all six tool schemas, capabilities, and contact information. The MCP Tool Reference re-fetches this every 10 minutes so it stays in sync automatically.	/.well-known/mcp/server-card.json	Live
API Catalog RFC 9727	Linkset that anchors the REST API, MCP namespace, ACP surface, and UCP surface. The single entry point for crawlers that follow RFC 9727 discovery chains.	/.well-known/api-catalog	Live

Connecting via MCP

The MCP server speaks Streamable HTTP at https://onwardticket.us/api/mcp (POST only — a GET against it is not a stream and will 404). This is the transport modern clients try first. The legacy SSE endpoint at https://onwardticket.us/api/mcp/sseis retained because ChatGPT's connector speaks only SSE; it is session-affine and less reliable behind the load balancer. No authentication is required for the public tool surface on either.

Claude Desktop (modern — Streamable HTTP)

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "onwardticket": {
      "url": "https://onwardticket.us/api/mcp"
    }
  }
}

Claude Desktop (older — via mcp-remote proxy)

If your client cannot reach an HTTP MCP endpoint directly, use the mcp-remote proxy shim:

{
  "mcpServers": {
    "onwardticket": {
      "command": "npx",
      "args": ["mcp-remote", "https://onwardticket.us/api/mcp"]
    }
  }
}

npx mcp-remote bridges stdio ↔ HTTP for clients that speak only stdio. Both configs give access to the same six tools.

Rate Limits

Tier	Limit	Applies to
Default	60 requests / minute / IP	All public endpoints — `/api/services`, `/api/quote`, `/api/orders/lookup`, MCP tools
Strict	10 requests / minute / IP	Sensitive endpoints — login, forgot-password, password-reset

Limits are per-IP. MCP SSE discovery endpoints (/.well-known/*) are exempt from throttling — AI crawlers may hammer them freely.

API Key Authentication (Production)

The developer-facing REST endpoints (GET /api/services, POST /api/quote, GET /api/orders/lookup) support optional API key gating. When the API_KEYS environment variable is unset on the API service, the guard is a no-op and all requests pass through (open mode, safe default for development).

In production, set API_KEYS to a comma-separated list of valid keys on the api service. Pass the key via header or query param:

# Header (preferred)
curl -H "X-API-Key: your-key" https://onwardticket.us/api/services

# Query param
curl "https://onwardticket.us/api/services?api_key=your-key"

Quotes and search stay public. Minting a pay link — MCP place_order and REST POST /api/v1/pay-links — requires a partner API key (X-API-Key). Website checkout (POST /api/orders) is unchanged.