Agent Wranglers

AGT-57Optional

Explain how agents sign up

If agents must register before using your service, explain how in an auth.md file at the root of your service.

By Agent Wranglers. Updated .

Review by

2027-04-30

How to do it

Experimental. This rests on a draft or a proposal, not a standard, so recheck it by the review date. Write /auth.md to explain how an agent gets scoped, revocable credentials for a user. Follow the section order of the proposal, from discovery to revocation. Point to your OAuth protected resource metadata for the exact endpoints, and keep those as the source of truth. auth.md is an open proposal that WorkOS published in 2026, not a standard, so check its current version before you build on it. Give each agent token at most its owner's rights, as Limit tokens and agents to what their owner may do says.

Examples

Markdown example

# auth.md

Resource server: api.example.com. Authorization server: auth.example.com.

## Discover
Read https://api.example.com/.well-known/oauth-protected-resource first.

## Pick a method
## Register
## Claim ceremony
## Exchange the assertion
## Use the access_token
## Errors
## Revocation

How to check

/auth.md answers 200. Every endpoint it names also appears in /.well-known/oauth-protected-resource.

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/auth-md">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.