# Authenticating & paying at zeroclass

zeroclass has **no signup**. Machine access is pay-per-use over ZeroClick rails; public reads need no credential at all.

## Public reads — no credential
These are free and unauthenticated: `/llms.txt`, `/openapi.json`, `/auth.md`, `/docs`, `/.well-known/*`, `/sitemap.xml`, and the human `/` landing. The insane-deal rule **blob** is sold via `GET /v1/rules` (metered), but the guides describing it are public.

## Pay-per-call — GET /v1/deals, GET /v1/rules (service `zeroclass`)
Call via the pay URL base `https://zeroclass.pay.zeroclick.io/*`. An unsigned/unpaid call returns a **402** x402 (Base) / MPP (Tempo) challenge. Settle it and retry to receive the result — `zero fetch <url> --max-pay 0.30` does the whole dance.

- `GET /v1/deals` → meter `deal_query`, **$0.15** per call.
- `GET /v1/rules` → meter `rules_read`, **$0.05** per call.

## Prepaid credit — watches (service `zeroclass-watches`)
Watches use a long-lived daily meter, so they draw a **prepaid credit** balance instead of a per-call 402:

- `POST /v1/watches` → `watch_created` **$0.25** on create.
- then `watch_day` **$0.10/day** while the watch runs.
- `GET /v1/watches` and `DELETE /v1/watches/:id` are **free** (signed, no draw).

Top up **once, minimum $5**, by POSTing `{"amountUsd":"5"}` to the credit pay URL:

    https://zeroclass.pay.zeroclick.io/plans/pln_HSWfO_TuCrp2BxQUBZjan/purchase

That returns a 402 for the $5; settle it (e.g. `zero fetch ... --max-pay 5.00`) to get a credit grant on `zeroclass-watches`. An unpaid `POST /v1/watches` returns a 402 carrying serviceSlug `zeroclass-watches` + usage `[{meterSlug:watch_created, quantity:1}]`; settle and retry. A watch SUSPENDS when credit runs out and RESUMES after you top up again.

## Cheapest funding: a human Zero signup
A first-time **human** Zero signup (`zero auth login`, browser device flow) gets a **$5 welcome bonus** that covers the exact minimum top-up. An anonymous `zero auth agent register` account gets no bonus and starts at $0 — so if a human is available, have them sign in FIRST.

## Signatures
All `/v1/*` routes are ZeroClick-signed. A signature failure is a **401**; an unpaid metered/watch call is a **402** challenge. See `/openapi.json` and `/llms.txt` for the full contract.