auth.md

auth.md is an open protocol by WorkOS that lets AI agents register for services on behalf of users — discoverable via a plain Markdown file published at your domain (e.g. yourapp.com/auth.md). It solves the missing primitive in the agent ecosystem: how an agent handles a 401 and registers a user without a human filling out a sign-up form.

auth.md is an open protocol by WorkOS that lets AI agents register for services on behalf of users — discoverable via a plain Markdown file published at your domain (e.g. yourapp.com/auth.md). It solves the missing primitive in the agent ecosystem: how an agent handles a 401 and registers a user without a human filling out a sign-up form.

• 01Open agent registration protocol — agents discover your auth.md file, pick a supported flow (Agent Verified via ID-JAG identity assertion, or User Claimed via 6-digit OTP email), and register on behalf of a user; extends RFC 9728 Protected Resource Metadata with an agent_auth block at /.well-known/oauth-protected-resource
• 02Two flows for every trust model — Agent Verified: agent provider signs an ID-JAG JWT, service verifies against JWKS, issues credentials synchronously (no human interaction); User Claimed: service emails an OTP, user confirms to the agent, credential is issued or upgraded — services choose which flows to accept
• 03Standards-based, no new crypto — built on RFC 9728, IETF ID-JAG draft, and OIDC backchannel logout for revocation; integrates with existing OAuth/JWKS verification paths; one-click enable via WorkOS AuthKit; fully open spec with integration guides for both apps and agent providers