# Access and authentication

The current LUCA Plus preview is `https://luca-plus-agents-preview.pages.dev`. It uses HTTP Basic Auth only for the landing routes `/` and `/agents`. The username is `luca`. Ask the site owner for the password. Send it over HTTPS, and do not put it in a URL, repository, or CLI argument.

| Route group | Access | Expected result without credentials |
| --- | --- | --- |
| `/`, `/agents`, `/agents/`, and landing file aliases | Basic Auth | 401 with `WWW-Authenticate` |
| `/docs/`, `/skills/`, `/downloads/`, static JS and CSS | Public | 200 for existing files |
| `/llms.txt`, `/llms-full.txt`, `/agents.txt`, `/openapi.json` | Public | 200 |
| `/api/v1/*` | Public, 100 requests per IP per minute | Route response; no Basic Auth challenge |
| `POST /mcp` | Public, shares the API limit | JSON-RPC response for a valid request |
| `/sign-up/`, `/contact/` | Public | Redirect to official LUCA site |

A valid `/index.html` request redirects to `/` after the same Basic Auth check. Encoded landing aliases receive the same check.

For the landing page, use a browser password prompt. For an HTTP check, send a Basic Auth header with the `luca` username. The Worker compares the complete credentials and returns `Cache-Control: no-store`. When `PREVIEW_BASIC_AUTH_PASSWORD` is missing, only the landing routes return 503. The secret is set in Cloudflare Pages or an ignored local `.dev.vars` file. There is no public API token or MCP password.

`PREPRODUCTION=true` sends `X-Robots-Tag: noindex, noarchive` on preview responses. The preview `robots.txt` allows crawlers to read public guides, docs, and tools. Search engines must not index these preview responses. The landing page still needs Basic Auth. Before public search discovery, LUCA must review claims, connect `https://agents.lucaplus.com`, and change the release indexing setting.

The MCP and event routes check the browser `Origin` header. The event route accepts only named actions and no personal data. The readiness route returns a result without storing its answers.

The API and MCP limit uses the Cloudflare client IP header. Each site allows 100 combined API and MCP requests in one fixed minute. The next request returns HTTP 429 and a `Retry-After` header. If the counter binding or client IP is unavailable, these routes return HTTP 503. Public documentation and downloads do not use this limit.