CIMD
Agents managed by an enterprise identity provider or agent platform that issues signed identity assertions. Enables zero-human automatic onboarding.
CIMD (Client Identity Metadata Document) is the auth.md flow where the agent presents a signed ID-JAG identity assertion from a trusted identity provider. The service validates the assertion and issues credentials automatically without human approval.
How It Works
CIMD enables trust-based automatic agent registration. An agent's identity is vouched for by a trusted identity provider. The agent presents a signed JWT assertion (ID-JAG) to the service's register_uri. The service validates the assertion's signature and, if trusted, issues credentials automatically.
The identity assertion carries: the agent's identity (sub), the issuing provider (iss), the target service audience (aud), and requested scopes. The service fetches the provider's JWKS to verify the signature.
Steps
- 1
Agent fetches /auth.md and reads CIMD flow declaration
- 2
Agent requests an ID-JAG from its identity provider
- 3
Agent POSTs the ID-JAG to the service's register_uri
- 4
Service verifies the ID-JAG signature against the provider's JWKS
- 5
Service issues API key or access token based on the assertion's claims
- 6
Agent uses issued credentials for subsequent API calls
When to use
Agents managed by an enterprise identity provider or agent platform that issues signed identity assertions. Enables zero-human automatic onboarding.
Example
// Agent POSTs to register_uri with ID-JAG
POST /agent/register HTTP/1.1
Host: api.example.com
Content-Type: application/json
Authorization: Bearer <signed-id-jag>
HTTP/1.1 201 Created
{"api_key": "sk_live_abc123", "scopes": ["read:data"]}