# Authentication

Aback Audit needs no authentication.

- Identity type: `anonymous`.
- Credential type: `none`.
- No API key, no OAuth token, no cookie. Any credential that is sent is ignored.

The service identifies a client by its address and limits how many audits it can start.
Identify your agent by sending a user agent of the form `your-agent/1.0 (+https://example.com/agent)`.
It is not required, but it helps when something goes wrong.

## Limits

| Limit | Value |
| --- | --- |
| New audits | 10 per hour |
| Concurrent audits | 3 |
| Reads | 120 per minute |
| Audits of one domain | 4 per hour, 1 at a time |
| Result cache | 15 minutes |

Every response carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`.
A `429` also carries `Retry-After` in seconds.