# auth.md [3 · Permit](/category/permit/) | auth.md | | --- | | Category | [Permit](/category/permit/) | | Governed by | Single vendor (auth-md.com, associated with WorkOS and founder Fabricio Telles); adopted by several named third parties (Resend, Cloudflare, Firecrawl, Alpic, here.now, mailbox.bot) who each publish their own auth.md file | | Status | Published protocol specification at auth-md.com/specification; not submitted to IETF, W3C, or any standards body | | Phase | draft | | Implementation | multi-implementation | | Adoption | claimed — auth-md.com, which lists Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as 'already supported' adopters | | Version | Launched 2026-06, current spec undated beyond launch (2026-06) | | Specification | [https://auth-md.com/specification](https://auth-md.com/specification) | | Found at | /auth.md | | Acronym collisions | Not to be confused with the unrelated ACT-AUTH.md convention published in the actcore/act-spec repository, which addresses similar ground independently | | Last checked | 2026-09-06 | [Permit](/category/permit/) auth.md is a single-vendor protocol, launched by WorkOS-affiliated auth-md.com at MCP Night 4 during the AI Engineer World's Fair 2026, that lets an AI agent register a new user account on a service directly, without a human filling out a sign-up form or an existing OAuth client registration [[1]](#ref-1). It targets a specific gap in the permit space: existing OAuth flows assume a client and a resource server already have a trust relationship (a registered client_id); auth.md instead lets a never-before-seen agent discover how to create that relationship in the first place. ## Overview The published specification defines three registration flows: an 'identity_assertion' flow where the agent's own identity provider vouches for the user via an ID-JAG (an emerging IETF identity-assertion mechanism) and registration completes with no human present; a 'service_auth' flow; and an 'anonymous' flow using an OTP the human reads back to the agent to bind the new account to the right person [[1]](#ref-1). auth.md is explicitly built as a thin composition layer on top of two existing IETF specs rather than a replacement for OAuth: discovery starts from a 401 response whose WWW-Authenticate header points to RFC 9728 Protected Resource Metadata at /.well-known/oauth-protected-resource, which in turn points to RFC 8414 Authorization Server Metadata [[1]](#ref-1). It does not define payment (the vendor's own materials pair it with x402 for that), and it does not define content-use permissions — its scope is strictly account creation. It is not on any standards track; auth-md.com is a commercial site operated in connection with WorkOS and credits an individual founder, Fabricio Telles. As of this verification (2026-09-06), the specification text is published and internally coherent, and the vendor's own homepage names nine companies as already serving their own auth.md file (Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic), each linked to that company's specific URL [[2]](#ref-2). Because this adoption count is self-reported by auth-md.com rather than independently measured by this wiki's own probe, the adoption level is recorded as claimed (by auth-md.com), not measured; implementation is recorded as multi-implementation on the strength of multiple named, independent adopting companies, though this pass did not fetch each named company's individual /auth.md file to confirm live service. What is unresolved: whether ID-JAG, the identity-assertion mechanism the strongest flow depends on, is itself standardized enough to interoperate across identity providers (it is described here as 'an emerging IETF draft'); how widely auth.md is adopted beyond the launch partners named on its own site; and how it will be distinguished in practice from the unrelated, independently-developed ACT-AUTH.md convention found in the actcore/act-spec repository, which addresses similar agent-credential ground under the same filename pattern. ## Discovery and probe A markdown convention file at the site root, cross-referenced with RFC 9728 Protected Resource Metadata for the actual OAuth exchange · /auth.md ``` GET {origin}/auth.md parse: A markdown document describing one or more of the three named flows (identity_assertion, service_auth, anonymous) and referencing /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server per RFC 9728/8414 on absent: No auth.md file at the site root; the service has not published an agent self-registration convention ``` Live check run by [the MCP probe](/mcp/server-card): GET /auth.md. auth.md describes one or more of the three named flows. ``` { "path": "/auth.md", "expect": { "text_match": "identity_assertion|service_auth|anonymous" }, "note": "auth.md describes one or more of the three named flows." } ``` ## History - 2026-09-06 — created and verified against auth-md.com/specification and auth-md.com (occupant-diff candidate) ## Instances - [WorkOS](https://workos.com/auth.md) · Recorded 2026-09-06 · site - [Resend](https://resend.com/auth.md) · Recorded 2026-09-06 · site - [Firecrawl](https://firecrawl.dev/auth.md) · Recorded 2026-09-06 · site - [Cloudflare](https://cloudflare.com/auth.md) · Recorded 2026-09-06 · site - [auth-md.com specification and reference skill](https://auth-md.com/specification) · Recorded 2026-09-06 · site - [webhooks.cc](https://webhooks.cc/blog/ai-agents-self-register-auth-md) · Observed 2026-06-02 · site - [Cloudflare, Firecrawl, Resend, Monday.com](https://bmdpat.com/blog/auth-md-agent-user-registration-2026) · Observed 2026-05-28 · network - [WorkOS (AuthKit Agent Registration)](https://workos.com/blog/agent-registration-with-auth-md) · Observed 2026-05-21 · service Every instance with its source is listed on the [instances page](/instances/). ## See also - Not to be confused with: Not to be confused with the unrelated ACT-AUTH.md convention published in the actcore/act-spec repository, which addresses similar ground independently ## References - auth-md.com's own specification page defines three registration flows (identity_assertion + ID-JAG, service_auth, anonymous), a discovery sequence built on RFC 9728 Protected Resource Metadata and RFC 8414 Authorization Server Metadata, and states the protocol was launched at MCP Night 4 / AI Engineer World's Fair 2026. — [https://auth-md.com/specification](https://auth-md.com/specification) (2026-06) VERIFIED - The auth-md.com homepage names Resend, Cloudflare, Firecrawl, Ora.ai, here.now, mailbox.bot, agents-txt.com, WorkOS, and Alpic as parties already publishing an auth.md file, each linked to that company's own /auth.md URL. — [https://auth-md.com/](https://auth-md.com/) (2026-06) REPORTED [JSON](/data/protocols/auth-md.json) · [Markdown](/protocols/auth-md/index.md)