Cooler Heads Authentication

generated: '2026-08-09'
method: searched
source: https://www.coolerheads.com/llms.txt
docs: https://dev.wix.com/docs/develop-websites/articles/get-started/about-the-wix-site-mcp
summary: >-
  Cooler Heads publishes no developer API and therefore no API key programme, OAuth
  server or developer credential of any kind. The one callable surface it serves is the
  anonymous Wix Site MCP endpoint. Connecting to that endpoint requires no
  authentication at all; acting on a visitor's behalf requires an ephemeral visitor
  token that any anonymous caller can mint from the endpoint itself via the
  GenerateVisitorToken tool. There is no user login, no consent step, and no scope
  model.
schemes:
- name: none
  applies_to: https://www.coolerheads.com/_api/mcp
  type: none
  description: >-
    The MCP transport accepts unauthenticated JSON-RPC. initialize, tools/list and the
    read-only tools (GetBusinessDetails, SearchInSite, SearchSiteApiDocs, the Wix docs
    readers) all returned 200 with no credential presented.
  evidence: 'POST tools/list with no Authorization header returned HTTP 200 with 9 tools (probed 2026-08-09)'
- name: visitorToken
  applies_to: https://www.coolerheads.com/_api/mcp
  type: bearer-like session token
  description: >-
    CallWixSiteAPI and ExecuteWixAPI require a visitorToken argument. The token is
    obtained from the same endpoint by calling GenerateVisitorToken, which itself takes
    no parameters and no credential — so the token is an anonymous session handle, not
    an authentication factor. It scopes the caller to the Wix visitor role on this site.
  issued_by: GenerateVisitorToken tool on https://www.coolerheads.com/_api/mcp
  evidence: 'tools/list inputSchema for CallWixSiteAPI and ExecuteWixAPI marks visitorToken as required'
discovery:
  openid_configuration: absent (HTTP 400)
  oauth_authorization_server: absent (HTTP 400)
  oauth_protected_resource: absent (HTTP 400 at host root, 404 under /_api/mcp)
scopes: none published
absent:
- API key programme
- OAuth 2.0 / OIDC
- mTLS
- signed requests
- developer account or sign-up
x-evidence:
  fetched: '2026-08-09'
  urls:
  - url: https://www.coolerheads.com/llms.txt
    http_status: 200
  - url: https://www.coolerheads.com/_api/mcp
    http_status: 200
  - url: https://www.coolerheads.com/.well-known/openid-configuration
    http_status: 400