# PulseSensor authentication and public access

## Public read-only access

Public pages, [product JSON](https://pulsesensor.com/products/pulse-sensor-amped.js),
[developer documentation](https://pulsesensor.com/pages/developers) and the
[research gateway](https://pulsesensor.com/pages/agent-research-gateway-v1-test)
require no login, API key, bearer token, OAuth consent or scopes.
Do not send credentials, personal records or live physiological data with reads.

## Permissions and boundaries

The documented API grants public product reads only. It does not grant Admin
API access, private customer/order access, cart changes or payment permission.
Research tools query the published catalog. Reading creates no account.

## Commerce and accounts

Shopify manages separate [commerce discovery](https://pulsesensor.com/.well-known/ucp)
and customer sign-in. Follow current discovery and official account UI only
when that workflow is requested. Do not invent credentials or identity endpoints.
Direct Shopify orders are paused; see [buying routes](https://pulsesensor.com/pricing.md).
Public catalog availability does not prove enabled checkout or shipping.

## Safe first request

GET https://pulsesensor.com/products/pulse-sensor-amped.js needs no Authorization
header. Missing handles return HTTP 404 and may have an empty body. Check status
before parsing JSON; back off on HTTP 429. No write is needed to test access.

[OpenAPI](https://pulsesensor.com/openapi.json) · [Support](https://pulsesensor.com/pages/contact)