auth.md is robots.txt for AI agent registration (WorkOS open spec)

Every agent product demo hits the same wall: the agent needs an account on a third-party service, and the service only offers a human sign-up form.

There is no standard machine-readable way to say "here is how an agent registers a user on your behalf."

WorkOS shipped auth.md in May 2026 to fix that gap. Think robots.txt, but for agent registration.

The file and the discovery path

You publish a Markdown file at:

https://yourapp.com/auth.md

It describes:

• Which registration flows you support
• Which scopes exist
• How credentials are issued, audited, and revoked

Machine discovery is a two-hop OAuth metadata path:

1. /.well-known/oauth-protected-resource (RFC 9728 Protected Resource Metadata)
2. /.well-known/oauth-authorization-server with an agent_auth block

That block lists register_uri, claim_uri, revocation_uri, and identity_types_supported.

Return WWW-Authenticate: Bearer resource_metadata="..." on 401 responses so agents that bump your API cold can find the registration path without scraping marketing pages.

Spec hub: auth.md protocol.

Announcement: WorkOS agent registration blog.

Two registration flows

Agent verified (no human in the loop)

A trusted agent provider (OpenAI, Anthropic, Cursor, etc.) attests user identity with an ID-JAG (Identity Assertion Authorization Grant).

Flow:

1. Agent requests audience-specific ID-JAG from its provider
2. Agent POSTs to your /agent-auth endpoint
3. You verify JWT signature against provider JWKS
4. Validate aud, exp, iat, jti, client_id
5. Issue scoped credentials synchronously

If you already JIT-provision users from an OIDC IdP, this is a small extension, not a greenfield auth system.

User claimed (OTP ceremony)

For apps without a participating agent provider:

1. Agent registers anonymously or with email
2. User receives OTP / verification code
3. User confirms in browser (/agent-auth/claim and /agent-auth/claim/complete)
4. Scopes upgrade in place after claim

Variants include anonymous start (limited creds immediately, upgrade after claim) and email required (no creds until OTP completes).

Who already ships it

WorkOS cites early adopters including Cloudflare, Firecrawl, and Resend.

The protocol is open (MIT). WorkOS authors the spec; you do not need a WorkOS account to publish auth.md or implement the endpoints.

Explainer: What is auth.md?.

Implementation checklist for app teams

Roughly what shipping looks like:

Credentials are short-lived scoped OAuth tokens tied to the user. Reuse your existing API auth middleware.

Why this matters for AI SEO and agent-ready products

I write about llms.txt and extractable site copy for a reason: agents are becoming a traffic segment.

auth.md is the auth counterpart:

• llms.txt tells agents what your product does
• auth.md tells agents how to onboard users safely

If you sell B2B SaaS and agents are in your 2026 roadmap, publishing discovery metadata is closer to schema.org in 2012 than to a gimmick. Early movers get fewer broken agent demos and fewer support tickets from "the bot could not sign up."

Pair with secrets vaults instead of dotenv on the agent side. Registration spec on the service; vault on the client.

Threat model notes (short)

No protocol eliminates abuse. Plan for:

• Scope minimization on first registration
• Revocation endpoints actually wired (not dead JSON)
• Audit logs tying agent client_id to user actions
• Rate limits on /agent-auth and claim endpoints

Agent verified flow shifts trust to provider JWKS. Maintain an allowlist of issuers you trust, same as enterprise SSO.

Bottom line

Agents need auth. There was no spec for it.

auth.md gives services a prose contract and OAuth metadata hooks so agents can register users without pretending to be a browser filling forms.

If you are building agent-facing APIs or lead sites that agents will operate, I would add auth.md to the same checklist as llms.txt and structured pricing pages.

Want help auditing whether your stack is agent-ready (auth, metadata, citation surfaces)? Book a free discovery call.