# auth.md

Telling an agent how to register for an account and get its own credentials, without a signup form or a consent screen.

**[Capabilities](/docs/capabilities)** · watched, not scored

Every other signal here assumes the agent is already allowed in. auth.md is the step before that, and its machine-readable half is an agent_auth block inside the OAuth metadata the MCP authorization signal already reads. An agent that finds a block advertising a registration method the service does not actually run has no way to get credentials, and no way to tell that from a service that never offered any.

## Why we do not score it

One vendor's 0.x specification with no standards body, and it still renames things a client can see: v0.6.0 (2026-06-10) moved the email path out of identity_assertion into a new service_auth type and dropped verified_email from the assertion list. Score it once the specification reaches 1.0 or is submitted to a standards body, and agent_auth blocks appear beyond the authors' own ecosystem.

## Adoption

**Early pilots** (L1)

Named early adopters exist, behind flags or trials. Nothing has been independently measured yet. Direction of travel: ▲ rising, as of 2026-08-26.

Published by WorkOS on 2026-05-22 under MIT and at v0.6.0 by 2026-06-10, with Resend, here.now and Ora.ai listed as live services and Cloudflare, OpenAI, Anthropic, Cursor and Firecrawl named on the agent-provider side. No independent measurement of how many services publish an agent_auth block.

| Adopter | Depth | Evidence |
|---|---|---|
| Resend, here.now, Ora.ai (services) | production | [auth-md.com](https://auth-md.com/) |
| WorkOS (author) | production | [workos.com](https://workos.com/blog/agent-registration-with-auth-md) |

## Specifications

| Document | Revision | Kind |
|---|---|---|
| [auth.md protocol specification](https://github.com/workos/auth.md/blob/main/AUTH.md) | v0.6.0 | specification |
| [RFC 9728 (OAuth Protected Resource Metadata, the discovery entry point)](https://www.rfc-editor.org/rfc/rfc9728) | living document | specification |

Last re-read against the published documents: 2026-08-26.