---
title: "Explain how agents sign up · Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/auth-md
id: AGT-57
level: Optional
applies: public-api
updated: 2026-10-27
build: a2a6bdfed830
tokens: 751
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Explain how agents sign up

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Ready for AI agents](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AGT-57
- Level: Optional
- Chapter: [Ready for AI agents](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents.md)
- Rule: If agents must register before using your service, explain how in an `auth.md` file at the root of your service.
- Check: `/auth.md` answers 200. Every endpoint it names also appears in `/.well-known/oauth-protected-resource`.
- Applies when: The project offers an API to others.
- Review by: 2027-04-30
- How: Experimental. This rests on a draft or a proposal, not a standard, so recheck it by the review date. Write `/auth.md` to explain how an agent gets scoped, revocable credentials for a user. Follow the section order of the proposal, from discovery to revocation. Point to your OAuth protected resource metadata for the exact endpoints, and keep those as the source of truth. auth.md is an open proposal that WorkOS published in 2026, not a standard, so check its current version before you build on it. Give each agent token at most its owner's rights, as [Limit tokens and agents to what their owner may do](https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Markdown example

```md
# auth.md

Resource server: api.example.com. Authorization server: auth.example.com.

## Discover
Read https://api.example.com/.well-known/oauth-protected-resource first.

## Pick a method
## Register
## Claim ceremony
## Exchange the assertion
## Use the access_token
## Errors
## Revocation
```

## Related rules

- ACC-39 [Limit tokens and agents to what their owner may do](https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions.md) in Accounts and identity

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/auth-md">Agent Wranglers agents as users playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Sign your bot's requests](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/web-bot-auth.md)
- Next: [Publish each page's data as a file](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/structured-data-for-agents.md)
- [Ready for AI agents](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents.md)