# Aloha Fungi B2B API Authentication

The documented Aloha Fungi B2B REST API and MCP server are public and do not require an API key, OAuth token or user account.

The inquiry endpoint requires application-level buyer consent. A client must set `consent_to_contact` to `true` only after the buyer has reviewed the inquiry summary and explicitly agreed to sales contact.

Do not send credentials in requests to these public endpoints. If a future API surface requires authentication, its security scheme will be added to the OpenAPI specification and announced under the versioning policy before it becomes required.

- OpenAPI: https://b2b.alohafungi.pl/openapi.json
- Versioning policy: https://b2b.alohafungi.pl/api-versioning.md
- Contact: https://b2b.alohafungi.pl/kontakt/