agenticweb.wiki

auth.md

Permit auth.md is a single-vendor protocol, launched by WorkOS-affiliated auth-md.com at MCP Night 4 during the AI Engineer World's Fair 2026, that lets an AI agent register a new user account on a service directly, without a human filling out a sign-up form or an existing OAuth client registration [1]. It targets a specific gap in the permit space: existing OAuth flows assume a client and a resource server already have a trust relationship (a registered client_id); auth.md instead lets a never-before-seen agent discover how to create that relationship in the first place.

Overview

The published specification defines three registration flows: an 'identity_assertion' flow where the agent's own identity provider vouches for the user via an ID-JAG (an emerging IETF identity-assertion mechanism) and registration completes with no human present; a 'service_auth' flow; and an 'anonymous' flow using an OTP the human reads back to the agent to bind the new account to the right person [1]. auth.md is explicitly built as a thin composition layer on top of two existing IETF specs rather than a replacement for OAuth: discovery starts from a 401 response whose WWW-Authenticate header points to RFC 9728 Protected Resource Metadata at /.well-known/oauth-protected-resource, which in turn points to RFC 8414 Authorization Server Metadata [1].

It does not define payment (the vendor's own materials pair it with x402 for that), and it does not define content-use permissions — its scope is strictly account creation. It is not on any standards track; auth-md.com is a commercial site operated in connection with WorkOS and credits an individual founder, Fabricio Telles.

As of this verification (2026-09-06), the specification text is published and internally coherent, and the vendor's own homepage names nine companies as already serving their own auth.md file (Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic), each linked to that company's specific URL [2]. Because this adoption count is self-reported by auth-md.com rather than independently measured by this wiki's own probe, the adoption level is recorded as claimed (by auth-md.com), not measured; implementation is recorded as multi-implementation on the strength of multiple named, independent adopting companies, though this pass did not fetch each named company's individual /auth.md file to confirm live service.

What is unresolved: whether ID-JAG, the identity-assertion mechanism the strongest flow depends on, is itself standardized enough to interoperate across identity providers (it is described here as 'an emerging IETF draft'); how widely auth.md is adopted beyond the launch partners named on its own site; and how it will be distinguished in practice from the unrelated, independently-developed ACT-AUTH.md convention found in the actcore/act-spec repository, which addresses similar agent-credential ground under the same filename pattern.

Discovery and probe

A markdown convention file at the site root, cross-referenced with RFC 9728 Protected Resource Metadata for the actual OAuth exchange · /auth.md

GET {origin}/auth.md
parse:     A markdown document describing one or more of the three named flows (identity_assertion, service_auth, anonymous) and referencing /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server per RFC 9728/8414
on absent: No auth.md file at the site root; the service has not published an agent self-registration convention

Live check run by the MCP probe: GET /auth.md. auth.md describes one or more of the three named flows.

{
 "path": "/auth.md",
 "expect": {
  "text_match": "identity_assertion|service_auth|anonymous"
 },
 "note": "auth.md describes one or more of the three named flows."
}

History

Instances

Every instance with its source is listed on the instances page.

See also

References

  1. auth-md.com's own specification page defines three registration flows (identity_assertion + ID-JAG, service_auth, anonymous), a discovery sequence built on RFC 9728 Protected Resource Metadata and RFC 8414 Authorization Server Metadata, and states the protocol was launched at MCP Night 4 / AI Engineer World's Fair 2026. — https://auth-md.com/specification (2026-06) VERIFIED
  2. The auth-md.com homepage names Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as parties already publishing an auth.md file, each linked to that company's own /auth.md URL. — https://auth-md.com/ (2026-06) REPORTED

JSON · Markdown