auth.md Agent Registration
ActiveSpecification for a Markdown file published at /auth.md on any service that tells AI agents how to register, which authentication flows are supported, and what credentials they can request. Enables agents to onboard to services without human interaction.
In one line
auth.md is a WorkOS specification (April 2025) for agent-readable registration instructions. A service publishes a Markdown file at /auth.md describing its supported auth flows (pre-registration, CIMD, DCR), identity types (anonymous, user-delegated, service), and credential types. AI agents discover it, parse it, and register autonomously without human guidance.
Quick Reference
| Field | Size | Description |
|---|---|---|
| File location | Path | Served at https://service.example.com/auth.md – root of the domain |
| register_uri | URL | Endpoint where agents submit registration requests |
| identity_types_supported | Array | anonymous, user-delegated, or service – what kind of identity the agent will use |
| credential_types_supported | Array | api_key, access_token, or none – what credential the agent gets after registration |
| flow | Enum | pre-registration (manual setup), CIMD (identity assertion), DCR (dynamic registration), none (anonymous) |
| scopes | Array | OAuth scopes the agent can request during registration |
Key Characteristics
Machine-readable Markdown
Markdown is both human-readable (for developers) and parseable by agents and LLMs without a schema.
Discovery first
Agents discover auth.md via documentation, search results, or the OAuth Protected Resource Metadata (RFC 9728) response.
Multiple flows
Services declare which registration flows they support. Agents walk the list and use the first supported flow.
No human required
An agent reads auth.md, registers via the specified flow, and receives credentials – all without prompting the user.
Message Format
# Example /auth.md file
# Auth
This service supports agentic registration.
## Registration
register_uri: https://api.example.com/agent/register
identity_types_supported: [anonymous, user-delegated]
credential_types_supported: [api_key, access_token]
## Flows
Supported flows (in priority order):
1. pre-registration – contact [email protected] for enterprise agents
2. CIMD – present a signed identity assertion for automatic approval
3. DCR – use OAuth 2.0 Dynamic Client Registration (RFC 7591)
## Scopes
Available scopes: read:data, write:data, admin
## Revocation
revoke_uri: https://api.example.com/agent/revoke// POST /agent/register (DCR flow)
{
"client_name": "my-research-agent",
"redirect_uris": [],
"grant_types": ["client_credentials"],
"token_endpoint_auth_method": "client_secret_post",
"scope": "read:data"
}
// 201 Created response
{
"client_id": "agent_abc123",
"client_secret": "secret_xyz",
"client_name": "my-research-agent",
"token_endpoint": "https://api.example.com/oauth/token"
}