How does an AI agent sign up to my service for a customer?
Before an agent can sign in to your service for a customer, it needs credentials, and getting them usually means a human filling in a form. auth.md is a short Markdown file at the root of your domain that tells an agent how registration works: which flows you support, which permissions it can ask for and where to go.
What it actually is
It is the "new accounts" desk with a sign written for robots. OAuth explains how to show your pass; auth.md explains how to get a pass in the first place. It is written in Markdown so that people and AI models read the same page, and it points to your OAuth metadata for the machine-precise details.
Why it matters
Agents are starting to act for people across many services at once, and the service that makes registration possible without a human copying keys around is the one an agent can actually use. For a product that wants to be picked by assistants, a documented way to register is the first step of every integration.
What good looks like
A real auth.md at the root of your domain that describes your registration flows, the scopes an agent may request and the endpoints involved, published alongside protected-resource metadata that agrees with it.
Being honest about it
This is an Advanced check: it never fails a page and stays out of your headline score. The protocol was published by WorkOS in May 2026 and is backed by a short list of agent-focused companies, so it is a forward-looking signal, not something most sites are expected to have. If your service has no accounts or API, a warning here is the expected result.
Where most sites go wrong
The common false alarm is a documentation site that answers any address ending in .md with a "page not found" written in Markdown, which looks like a file and is not one. The other is a placeholder auth.md with a heading and nothing else, published to satisfy a checklist rather than to help an agent.
Not sure where yours stands?
A free scan checks this and everything else in about 20 seconds — no signup. Or if it's already flagged and you'd rather it were simply handled, we do that too.
Flagged for this one? We handle it. No pitch, just a plain-English chat.
Book a call