Agent Auth Protocol

Agent Auth is an open protocol designed to provide AI agents with their own independent identity, cryptographic keys, and scoped capabilities. Unlike traditional OAuth or session-based models that force agents to inherit a human user's or an application's identity, Agent Auth treats each runtime agent as a first-class principal.

Key features include:

• Per-agent identity: Every agent receives a unique ID and its own cryptographic keypair.
• Scoped capabilities: Permissions are granted specifically to the agent for required actions.
• Independent lifecycle: Agents can be revoked or expired individually without affecting users or other agents.
• Full audit trail: Every request is attributed to a specific agent ID.
• Discovery: Agents can automatically locate services via well-known endpoints.

The following SDKs are currently in development and are listed as Coming soon:

• Python: Will support both server and client implementations.
• Rust Server SDK: Will support both server and client implementations.
• Go Server SDK: Will support both server and client implementations.

Agent Auth is an open, implementation-oriented protocol designed to provide AI agents with a distinct identity that is separate from users, OAuth clients, or API keys. It provides a standardized way for agents to:

• Register: Establish a formal identity within a system.
• Authenticate: Prove their identity to services.
• Receive Capabilities: Obtain specific permissions or functional scopes.
• Operate: Execute tasks across various services as a first-class principal.

This protocol addresses the limitations of traditional authentication models (like API keys or user-based OAuth) which lack visibility, granular scoping, isolation, and autonomous identity for agents operating without a human in the loop.

In the Agent Auth protocol, a server acts as the authorization authority for a service (e.g., a bank, GitHub, or any API). It is responsible for managing the lifecycle and permissions of agents that interact with that service.

Core Responsibilities:

• Discovery: Publishing a configuration endpoint for client auto-configuration.
• Registration: Managing host and agent identities using Ed25519 key verification.
• Authorization: Managing capability grants, approval flows, and enforcing constraints.
• Verification: Validating signed JWTs on every incoming request.
• Lifecycle: Enforcing agent expiry, reactivation, and revocation.

An agent is a runtime AI actor with its own server-side identity, granted capabilities, and lifecycle. It is the entity that is authenticated.

Crucially, an agent is not the host application (like Claude Code or ChatGPT); it is the specific runtime actor within that environment (e.g., a specific conversation or task).

To ensure security and auditability, every agent possesses:

• Continuity: The ability to be recognized as the same actor over multiple requests.
• Distinctiveness: The ability to be individually scoped, audited, and revoked without affecting other actors.

Agent Auth provides these properties by assigning each agent its own Ed25519 keypair, registration, and capability set.

The protocol involves three primary runtime participants:

Additionally, a User (Resource Owner) may be involved in the Approval phase if a registration is marked as pending.

Authentication in the Agent Auth Protocol is built on Ed25519 keypairs and short-lived JWTs. The protocol distinguishes between two primary token types:

1. Host JWTs: Used by hosts for management operations such as registration, status checks, reactivation, revocation, and key rotation.
2. Agent JWTs: Used by agents to execute capabilities. These are extremely short-lived (ideally expiring within 60 seconds) and must be re-signed for every request as there are no refresh tokens.

Both hosts and agents use EdDSA over Ed25519 keypairs in JWK format. The private key remains on the client, while the server only stores public keys or JWKS URLs.

{
  "kty": "OKP",
  "crv": "Ed25519",
  "x": "base64url-encoded-public-key"
}

User Approval Flow

When connecting to a new server for the first time, the client manages the approval process:

1. Receives a verification URI and user code from the server.
2. Presents these to the user.
3. Polls the server's status endpoint until approval is granted.
4. Returns the active agent.

Once a host is trusted, future requests for default capabilities are auto-approved.

Capability Escalation

If an agent requires additional capabilities at runtime that were not part of the initial connection, use requestCapability. This always triggers an explicit user approval flow, even for trusted hosts.

const result = await client.requestCapability({
  provider: "bank",
  capabilities: ["transfer_funds"],
  reason: "User asked to transfer money"
});
// Triggers approval flow if needed, returns updated grants

Public keys for hosts and agents can be provided to the server in two ways:

• Inline (JWK): The public key is sent directly during registration. This is the simplest method.
• JWKS URL: The public key is published at a URL that the server can fetch. This is recommended for key rotation and multi-service deployments where multiple services need to verify the same key.

In this protocol, Ed25519 is the only defined algorithm for keypairs.