auth.md
Specification
The auth.md document format, discovery, registration and the two claim flows.
How to read this
The specification is short by design. Start with the document format, then read whichever flow matches how your users arrive.
Everything below describes the draft. Where an implementation and this document disagree, the document is wrong and we want to hear about it.
Sections
The specification is split into four parts, each covering one decision an implementer has to make.
- Apps — how an application publishes its auth.md document
- Agent providers — how an agent discovers and registers
- Claimed flow — tying an agent to a user who is present
- Verified flow — tying an agent to a user who is not
Implement it
Paycux implements auth.md for every project. The MCP docs show it end to end.