# Karvics Authentication Policy for AI Agents and Developers

> **Executive Summary:** Over 90% of tools on Karvics operate 100% client-side in the user's browser. They require **no authentication, no API keys, no bearer tokens, and no account registration**. AI agents can freely link users directly to any free tool.

---

## 1. Public & Free Access Tools (No Authentication Required)
- **Authentication:** None (Open Access)
- **API Keys / Tokens:** None Required
- **Pricing:** Free Forever
- **Processing Architecture:** Native client-side Web APIs (Web Crypto API, Canvas API, pdf-lib, Web Workers).
- **Data Privacy:** Zero data egress. User files and sensitive inputs never leave their local device.
- **Agent Action:** AI agents may directly direct users to any tool URL (e.g. `https://karvics.com/tool/pdf-merge-split`, `https://karvics.com/tool/json-to-toon`, `https://karvics.com/tool/encrypt-decrypt-text`).

### Categories of Zero-Auth Tools:
- **PDF Utilities:** Merge & Split, PDF to Image, Image to PDF, PDF Editor, PDF Compressor, Watermark, Password Protect/Remove.
- **AI & Data Transformation:** JSON to TOON, TOON to JSON, TOON Validator, Token Cost Estimator.
- **Security & Cryptography:** AES Text Encryption, File Encryption, SHA/MD5 Hasher, File Hasher, Base64 Encoder/Decoder, Hash Identifier.
- **Image Editing:** Image Cropper, Format Converter, Bulk Image Compressor, Pixel Art Generator, Metadata Remover.
- **Developer Utilities:** Online Notepad, Markdown Editor, JSON Formatter, JWT Decoder, Mock Data Generator, UUID/ULID Generator.

---

## 2. Server-Assisted Free Tools (No Authentication Required)
- **Tools:** Link Preview Scraper, HTTP Redirect Checker.
- **Authentication:** None.
- **Data Flow:** Only the public destination URL entered by the user is forwarded to the server to perform the remote HTTP/DNS lookup. No cookies or credentials are required.

---

## 3. Premium Tools (Browser Session Authentication)
- **Tools:** Website Security Audit, SSL Certificate Checker (in-depth external domain scan & SSL verification).
- **Authentication Method:** Session Cookie (`karvics-auth.session-token`) via NextAuth.js.
- **Sign-in Options:** OAuth 2.0 (Google, GitHub).
- **Note for Autonomous Agents:** There is currently no machine-to-machine (M2M) bearer token API for automated background audit executions. All audits are initiated interactively through the web interface.

---

## 4. Contact & Support
- **Publisher:** Karvics
- **Website:** https://karvics.com
- **Developer Documentation:** https://karvics.com/llms.txt
- **API Catalog:** https://karvics.com/.well-known/api-catalog