The modern onboarding experience is a repetitive cycle of friction. Every time a professional discovers a new productivity tool or a developer finds a niche API, they encounter the same wall: the sign-up form. The process is a choreographed dance of entering an email address, navigating to an inbox to find a verification link, clicking that link, and then returning to the original tab to set a password. This sequence, while standard for humans, represents a significant point of churn. For the growing ecosystem of AI agents designed to automate workflows, these forms are not just annoying; they are architectural barriers that prevent autonomous systems from actually being autonomous.
The Architecture of the auth.md Manifest
To solve this bottleneck, WorkOS has released auth.md, an open protocol designed to allow AI agents to handle user registration and authentication without manual human intervention. The core of the system is deceptively simple: service providers host a file named `auth.md` at the root of their domain. This file serves as a standardized instruction manual for any AI agent attempting to interact with the service. Instead of the agent trying to guess how a specific website's sign-up flow works by scraping HTML, it reads the `auth.md` file to understand the supported registration flows, the required permission scopes, and the exact procedures necessary to create an account.
Because the protocol is released under the MIT license, it avoids the trap of vendor lock-in. Any company can implement the standard regardless of their existing infrastructure. The technical discovery process is handled through a well-known path, where agents look for the `/.well-known/oauth-authorization-server` configuration to locate the authentication server. This ensures that the agent knows exactly where to send credentials and how to request tokens without needing a hard-coded integration for every single service it encounters.
Shifting Identity from Forms to Token Exchange
The real shift occurs in how identity is proven. auth.md moves away from the concept of a user filling out a form and toward a system of delegated assertions. The protocol defines three distinct registration methods to balance user control with agent efficiency. The first is the Agent verified flow, where an Identity Provider (IdP) vouches for the user's identity, allowing the agent to proceed based on a trusted third-party assertion. The second is the User claimed flow, which follows the RFC 8628 device flow style. In this scenario, the agent presents a code to the user, who then logs in and confirms the code, effectively claiming the account created by the agent.
For cases where immediate identity verification is not possible, the protocol introduces Anonymous Registration. Here, the agent operates using a pre-claim scope, granting it temporary, limited permissions to set up the account. Once the human user eventually claims ownership of the account, the session is upgraded to a formal post-claim token. This creates a seamless transition from an agent-initiated setup to a human-owned account.
Under the hood, this entire process is built upon the established OAuth framework. The agent obtains an ID-JAG (Identity Assertion) and exchanges it for an access token via the RFC 7523 JWT-bearer grant. To mitigate security risks, the system issues scoped access tokens with short lifespans. This ensures that even if an agent is compromised, the potential damage is limited to a narrow set of permissions and a tight window of time.
This ecosystem relies on three primary actors: the Agent, the Agent Provider, and the Service. The Agent Provider acts as the IdP, issuing the ID-JAG that proves who the user is. The Service verifies this assertion and issues the final credentials. The Agent acts as the orchestrator, moving the identity assertions between the provider and the service to finalize the registration.
Early adoption is already visible across the developer toolchain. Companies including Cloudflare, Firecrawl, Resend, and monday.com have integrated the standard. By implementing these agent-readable registration environments, these platforms are effectively removing the physical and cognitive hurdles that typically slow down user acquisition.
Growth for digital services is no longer just about how intuitive the UI is for a human, but how accessible the API is for an agent. The power to initiate a relationship with a service is shifting from the person clicking the mouse to the agent managing the token exchange.
