Explain how agents sign up

If agents must register before using your service, explain how in an auth.md file at the root of your service.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Write /auth.md to explain how an agent gets scoped, revocable credentials for a user. Point to your OAuth protected resource metadata for the exact endpoints, and keep those as the source of truth. auth.md is an early vendor proposal, so check its current version before you build on it.

Example

# Getting access

1. Request an API key at https://example.com/developers.
2. Send it as `Authorization: Bearer <key>` on every request.
3. Keys expire after 90 days. Rotate them at the same page.

How to check

/auth.md answers 200. Every endpoint it names also appears in /.well-known/oauth-protected-resource.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/ready-for-ai-agents/auth-md.