auth.md is an open protocol by WorkOS that lets AI agents register for services on behalf of users — discoverable via a plain Markdown file published at your domain (e.g. yourapp.com/auth.md). It solves the missing primitive in the agent ecosystem: how an agent handles a 401 and registers a user without a human filling out a sign-up form.
Open agent registration protocol — agents discover your auth.md file, pick a supported flow (Agent Verified via ID-JAG identity assertion, or User Claimed via 6-digit OTP email), and register on behalf of a user; extends RFC 9728 Protected Resource Metadata with an agent_auth block at /.well-known/oauth-protected-resource
Two flows for every trust model — Agent Verified: agent provider signs an ID-JAG JWT, service verifies against JWKS, issues credentials synchronously (no human interaction); User Claimed: service emails an OTP, user confirms to the agent, credential is issued or upgraded — services choose which flows to accept
Standards-based, no new crypto — built on RFC 9728, IETF ID-JAG draft, and OIDC backchannel logout for revocation; integrates with existing OAuth/JWKS verification paths; one-click enable via WorkOS AuthKit; fully open spec with integration guides for both apps and agent providers