---
title: "Explain how agents sign up · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/ready-for-ai-agents/auth-md
updated: 2026-10-20
licence: "All rights reserved"
---

# Explain how agents sign up

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Ready for AI agents](https://agentwranglers.se/playbook/website/ready-for-ai-agents)
- Rule: If agents must register before using your service, explain how in an `auth.md` file at the root of your service.
- How: Write `/auth.md` to explain how an agent gets scoped, revocable credentials for a user. Follow the section order of the proposal, from discovery to revocation. Point to your OAuth protected resource metadata for the exact endpoints, and keep those as the source of truth. auth.md is an open proposal that WorkOS published in 2026, not a standard, so check its current version before you build on it.
- Check: `/auth.md` answers 200. Every endpoint it names also appears in `/.well-known/oauth-protected-resource`.

Example:

```md
# auth.md

Resource server: api.example.com. Authorization server: auth.example.com.

## Discover
Read https://api.example.com/.well-known/oauth-protected-resource first.

## Pick a method
## Register
## Claim ceremony
## Exchange the assertion
## Use the access_token
## Errors
## Revocation
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/ready-for-ai-agents/auth-md`.

- Previous: [Sign your bot's requests](https://agentwranglers.se/playbook/website/ready-for-ai-agents/web-bot-auth)
- Next: [Publish each page's data as a file](https://agentwranglers.se/playbook/website/ready-for-ai-agents/structured-data-for-agents)
- [Ready for AI agents](https://agentwranglers.se/playbook/website/ready-for-ai-agents)