auth.md
### TL;DR
auth.md is an open protocol by WorkOS that lets AI agents register for services on behalf of users — discoverable via a plain Markdown file published at your domain (e.g. yourapp.com/auth.md). It solves the missing primitive in the agent ecosystem: how an agent handles a 401 and registers a user without a human filling out a sign-up form.
Key Insights & Metrics
Key Features
- Open agent registration protocol — agents discover your auth.md file, pick a supported flow (Agent Verified via ID-JAG identity assertion, or User Claimed via 6-digit OTP email), and register on behalf of a user; extends RFC 9728 Protected Resource Metadata with an agent_auth block at /.well-known/oauth-protected-resource
- Two flows for every trust model — Agent Verified: agent provider signs an ID-JAG JWT, service verifies against JWKS, issues credentials synchronously (no human interaction); User Claimed: service emails an OTP, user confirms to the agent, credential is issued or upgraded — services choose which flows to accept
- Standards-based, no new crypto — built on RFC 9728, IETF ID-JAG draft, and OIDC backchannel logout for revocation; integrates with existing OAuth/JWKS verification paths; one-click enable via WorkOS AuthKit; fully open spec with integration guides for both apps and agent providers
→ Related Releases
Wiz Red Agent
The Wiz Red Agent is a security solution developed by Wiz to enhance threat detection and response capabilities within cloud environments. It leverages advanced AI technologies to automate threat investigation, providing security teams with rapid and transparent insights into potential security incidents.
PentAGI
PentAGI is a fully autonomous AI agent system designed to perform complex penetration testing tasks. Developed by VXControl, it leverages advanced AI capabilities to enhance cybersecurity assessments.
MiroThinker
MiroThinker is an open-source search agent model developed by MiroMindAI, designed for tool-augmented reasoning and real-world information seeking. It aims to match the deep research capabilities of leading AI models like OpenAI's Deep Research and Google's Gemini Deep Research.
Letta Code SDK
The Letta Code SDK is a software development kit that enables developers to build deeply personalized agents with persistent memory that learn over time. It serves as the interface to Letta Code, facilitating the creation of stateful agents capable of continuous learning and improvement.
Discussion
Sign in to leave a review
Reviews
No reviews yet. Be the first to review!