Open protocol
auth.md
An open protocol for how AI agents register with an application, discover the flows it supports, request scopes, and receive credentials that expire.
The problem it solves
An agent arriving at an application has no way to ask what it is allowed to do or how to ask for it. Every integration is bespoke, which means every integration is a new place to get authorization wrong.
auth.md is a small, readable document an application publishes describing how agents register, which flows it supports and which scopes exist. It is designed to be read by a model and by a person.
What it specifies
The document format, the discovery location, the registration exchange and the shape of a scope request. Nothing about how you authenticate your users — that stays yours.
- Where the document lives and how it is discovered
- How an agent registers and what it receives
- How scopes are named, requested and granted
- How a claim is tied to a real user account
Status
The specification is a working draft and will change. It is published openly so that implementations can disagree with it in public rather than in private.
Read the specification
The docs section covers the document format, the flows and worked examples.