# TrackForge auth.md

## Public ISRC lookup

The catalogued TrackForge Public ISRC Lookup API is deliberately unauthenticated. Agents and other clients do not need an account, API key, bearer token, cookie, or registration step.

- Endpoint: `POST https://api.trackforge.studio/api/v1/isrc-lookup/search`
- Request content type: `application/json`
- Request body: `{"isrcs":["QZMHN2217062"]}`
- Batch limit: 50 ISRCs per request
- Rate limit: 10 requests per minute per source IP
- Service description: `https://trackforge.studio/.well-known/openapi/isrc-lookup.json`

The response may contain partial source coverage when an upstream service is unavailable. Interpret The MLC result through `mlc_lookup.status` and `mlc_lookup.indeterminate`; a missing `mlc` object alone is not evidence that a work is unregistered.

## Private TrackForge product

The signed-in TrackForge product is for authorised human accounts. TrackForge does not publish an OAuth authorisation server or a general-purpose agent credential-provisioning flow. Automated clients must not reuse browser cookies or human sessions. Only services listed in the public API catalogue are available for unauthenticated automated use.

For commercial integration enquiries, contact `hello@trackforge.studio`.