auth.md File Specification

auth.md is a Markdown file published at the root of any service (/auth.md). It tells AI agents how to register and authenticate. The file is both machine-parseable (for automated agents) and human-readable (for developers).

Complete Example

/auth.md

http

# Auth

This service supports agentic registration.

## Registration

register_uri: https://api.example.com/agent/register
identity_types_supported: [anonymous, user-delegated, service]
credential_types_supported: [api_key, access_token, none]

## Flows

Supported flows (in priority order):
1. pre-registration – contact [email protected] for pre-issued API keys
2. CIMD – present a signed identity assertion from a trusted identity provider
3. DCR – use OAuth 2.0 Dynamic Client Registration (RFC 7591)
4. anonymous – access public endpoints without registration

## Scopes

Available scopes:
- read:data – read access to all public datasets
- write:data – create and update records
- admin – administrative access (requires pre-registration or CIMD only)

## Revocation

revoke_uri: https://api.example.com/agent/revoke

To revoke credentials: DELETE https://api.example.com/agent/revoke/{client_id}
with Authorization: Bearer {access_token}

## Support

For integration assistance: [email protected]
Status page: https://status.example.com

Key Fields

Field	Required	Description
`register_uri`	Required	Endpoint where agents POST registration requests. Required for any registration flow.
`identity_types_supported`	Required	Array: anonymous, user-delegated, or service. What kind of identity the agent uses.
`credential_types_supported`	Required	Array: api_key, access_token, or none. What credential the agent receives after registration.
`revoke_uri`	Optional	Endpoint to revoke credentials. Agents call this when decommissioning.
`scopes`	Optional	Available OAuth scopes and their descriptions. Helps agents request minimal permissions.
`token_endpoint`	Optional	OAuth token endpoint. Required if credential_types_supported includes access_token.
`flows`	Optional	Supported registration flows in priority order. Agents walk the list and use the first supported flow.

Registration Flows

Agents walk the flows list in priority order and use the first one they support.

Pre-Registration

Credentials distributed out-of-band before agent deployment. Enterprise agreements, developer portals, admin-provisioned access.

CIMD

Agents managed by an enterprise identity provider or agent platform that issues signed identity assertions. Enables zero-human automatic onboarding.

DCR

Open API ecosystems where any agent can self-register. No pre-existing trust relationship needed.

Anonymous

Public APIs, free tier access, read-only endpoints. No registration, no credentials.

auth.md Official Documentation →