auth.md: How AI Agents Will Sign Your Users Up

WorkOS introduced auth.md, an open protocol for AI-agent-based user signup and onboarding.

Apps publish an auth.md file that defines supported flows, scopes, and returned tokens.

The protocol supports two modes: Agent Verified and User Claimed, for different trust levels.

Several companies, including Cloudflare, Firecrawl, Resend, Monday.com, MCP, and AgentGuard, have already adopted it.

The article warns that agent signup can invite spam and runaway costs, so rate limits and spending caps should be built in early.