Back to Devoured - May 25, 2026
DEVOURED
auth.md (Website)

auth.md (Website)

Tech aiagentssecurity WorkOS
WorkOS introduced auth.md, an open protocol allowing AI agents to securely register users with apps without human interaction by asserting identities via Markdown files.
What: Auth.md, an open protocol by WorkOS, enables AI agents to register users for applications by fetching a Markdown file from the app's domain (e.g., https://yourapp.com/auth.md). This file outlines supported flows (like agent-verified identity assertions or OTP-based claims), available scopes, and registration endpoints, allowing agents' identity providers to vouch for users, eliminating manual sign-up forms.
Why it matters: This protocol addresses a crucial need for seamless agent integration into software workflows, paving the way for autonomous AI agents to manage user accounts and access services more efficiently, which is vital for the scalability and adoption of agent-based systems.
Takeaway: Developers building apps meant to interact with AI agents should explore publishing an `auth.md` file to streamline agent-based user registration and service access, using either agent-verified or user-claimed flows.
Deep dive
  • Auth.md is a Markdown file hosted at an application's domain (e.g., https://yourapp.com/auth.md) that defines how AI agents can register users.
  • It specifies supported registration flows (e.g., agent-verified, user-claimed via OTP), available scopes, and registration endpoints.
  • The "agent verified" flow allows an agent's identity provider to vouch for a user, requiring no human interaction.
  • The "user claimed" flow involves an OTP (one-time password) sent to the user for confirmation.
  • Apps retain control over accepted flows and the type of credentials issued to the agent (e.g., scoped API keys or access tokens).
  • Auth.md is an open protocol, not tied to WorkOS infrastructure, and leverages existing OAuth standards like Protected Resource Metadata and ID-JAG identity assertions.
  • WorkOS provides an AuthKit for easier implementation and is actively shaping the protocol with early adopters.
Decoder
  • Agent-verified flow: A registration method where an AI agent's identity provider asserts the user's identity, eliminating the need for direct human interaction.
  • User-claimed flow: A registration method where an AI agent triggers an OTP (one-time password) that the human user confirms, thereby claiming the account.
  • OAuth: An open standard for access delegation, commonly used for granting websites or applications access to information on other websites without giving them the password.
  • Protected Resource Metadata: Standardized way to describe the resources and capabilities of an OAuth 2.0 protected resource.
  • ID-JAG identity assertions: A standard related to identity assertions, often used in federated identity systems to convey user identity information securely.
Original article

auth.md

Enable agents to register users without the sign-up form. Auth.md provides secure agent registration that any app can implement.

Self-serve agent discovery

Publish auth.md at your domain with the flows, scopes, and endpoints an agent needs to register.

Choose the flows you support

Allow trusted identity assertions, OTP-based claim flows, or anonymous access.

Credentials you control

Issue scoped API keys or access tokens tied to users — auditable, expirable, revocable.

Get started

For services that want agents to register users on behalf of their customers.

For platforms whose agents act on behalf of users.

Get in touch to enable auth.md on your account.

FAQs

  • What is auth.md? A Markdown file an application hosts at its domain — typically https://yourapp.com/auth.md — that tells agents how to register on behalf of a user. It includes which flows are supported, which scopes exist, and how to register for the service.
  • How does an agent register a user with my app? The agent fetches your auth.md, picks a supported flow, and either presents a verified identity assertion (agent verified flow) or walks the user through an OTP-based claim (user claimed flow). You stay in control of which flows you accept and what credentials get issued.
  • What's the difference between the agent verified and user claimed flows? Agent verified is agent-attested — the agent's identity provider vouches for the user, no human interaction required. User claimed is OTP-based — the agent triggers a code, the human confirms, the account is claimed. Most apps support both and let the agent pick the right one for the situation.
  • What credentials get issued to the agent? Your service decides whether to return a scoped API key or access token tied to the user. This allows for re-use of your existing API auth methods.
  • Is auth.md a WorkOS only feature or an open protocol? It's open. WorkOS authors the protocol, but auth.md isn't tied to WorkOS infrastructure — it composes existing OAuth standards (Protected Resource Metadata, ID-JAG identity assertions) and any app can publish or any agent can read one with no WorkOS account required.
Explore all 62 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi