{
 "acronym": "",
 "adoption": {
  "by": "auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters",
  "level": "claimed",
  "probe_run": null
 },
 "aliases": [],
 "analog": "Self-service sign-up form",
 "collisions": [
  "Not to be confused with the unrelated ACT-AUTH.md convention published in the actcore/act-spec repository, which addresses similar ground independently"
 ],
 "discovery": {
  "mechanism": "A markdown convention file at the site root, cross-referenced with RFC 9728 Protected Resource Metadata for the actual OAuth exchange",
  "path": "/auth.md"
 },
 "dispute": null,
 "evidence": [
  {
   "claim": "auth-md.com's own specification page defines three registration flows (identity_assertion + ID-JAG, service_auth, anonymous), a discovery sequence built on RFC 9728 Protected Resource Metadata and RFC 8414 Authorization Server Metadata, and states the protocol was launched at MCP Night 4 / AI Engineer World's Fair 2026.",
   "date": "2026-06",
   "label": "VERIFIED",
   "url": "https://auth-md.com/specification"
  },
  {
   "claim": "The auth-md.com homepage names Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as parties already publishing an auth.md file, each linked to that company's own /auth.md URL.",
   "date": "2026-06",
   "label": "REPORTED",
   "url": "https://auth-md.com/"
  }
 ],
 "form": "document-format",
 "governance": "Single vendor (auth-md.com, associated with WorkOS and founder Fabricio Telles); adopted by several named third parties (Resend, Cloudflare, Firecrawl, Alpic, here.now, mailbox.bot) who each publish their own auth.md file",
 "group": null,
 "history": [
  {
   "date": "2026-09-06",
   "note": "created and verified against auth-md.com/specification and auth-md.com (occupant-diff candidate)"
  }
 ],
 "id": "auth-md",
 "implementation": "multi-implementation",
 "last_verified": "2026-09-06",
 "name": "auth.md",
 "native_status": "Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body",
 "origin": {
  "date": "2026-06",
  "org": "WorkOS (auth-md.com), publicly launched at MCP Night 4 / AI Engineer World's Fair 2026"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "draft",
 "probe": {
  "method": "GET",
  "on_absent": "No auth.md file at the site root; the service has not published an agent self-registration convention",
  "parse": "A markdown document describing one or more of the three named flows (identity_assertion, service_auth, anonymous) and referencing /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server per RFC 9728/8414",
  "path": "{origin}/auth.md"
 },
 "question": "How does an AI agent register a new account for its user on a service, without a human filling out a sign-up form or an OAuth redirect flow existing to authorize it?",
 "scope": "general",
 "spec_url": "https://auth-md.com/specification",
 "step": "permit",
 "summary_md": "auth.md is a single-vendor protocol, launched by WorkOS-affiliated auth-md.com at MCP Night 4 during the AI Engineer World's Fair 2026, that lets an AI agent register a new user account on a service directly, without a human filling out a sign-up form or an existing OAuth client registration [1]. It targets a specific gap in the permit space: existing OAuth flows assume a client and a resource server already have a trust relationship (a registered client_id); auth.md instead lets a never-before-seen agent discover how to create that relationship in the first place.\n\nThe published specification defines three registration flows: an 'identity_assertion' flow where the agent's own identity provider vouches for the user via an ID-JAG (an emerging IETF identity-assertion mechanism) and registration completes with no human present; a 'service_auth' flow; and an 'anonymous' flow using an OTP the human reads back to the agent to bind the new account to the right person [1]. auth.md is explicitly built as a thin composition layer on top of two existing IETF specs rather than a replacement for OAuth: discovery starts from a 401 response whose `WWW-Authenticate` header points to RFC 9728 Protected Resource Metadata at `/.well-known/oauth-protected-resource`, which in turn points to RFC 8414 Authorization Server Metadata [1].\n\nIt does not define payment (the vendor's own materials pair it with x402 for that), and it does not define content-use permissions — its scope is strictly account creation. It is not on any standards track; auth-md.com is a commercial site operated in connection with WorkOS and credits an individual founder, Fabricio Telles.\n\nAs of this verification (2026-09-06), the specification text is published and internally coherent, and the vendor's own homepage names nine companies as already serving their own auth.md file (Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic), each linked to that company's specific URL [2]. Because this adoption count is self-reported by auth-md.com rather than independently measured by this wiki's own probe, the adoption level is recorded as claimed (by auth-md.com), not measured; implementation is recorded as multi-implementation on the strength of multiple named, independent adopting companies, though this pass did not fetch each named company's individual /auth.md file to confirm live service.\n\nWhat is unresolved: whether ID-JAG, the identity-assertion mechanism the strongest flow depends on, is itself standardized enough to interoperate across identity providers (it is described here as 'an emerging IETF draft'); how widely auth.md is adopted beyond the launch partners named on its own site; and how it will be distinguished in practice from the unrelated, independently-developed ACT-AUTH.md convention found in the actcore/act-spec repository, which addresses similar agent-credential ground under the same filename pattern.",
 "track": "single-vendor",
 "version": {
  "date": "2026-06",
  "label": "Launched 2026-06, current spec undated beyond launch"
 },
 "url": "https://agenticweb.wiki/protocols/auth-md/",
 "category": "permit",
 "type": "protocol"
}