[Sponsor] WorkOS: Agents Need Auth. There’s Now a Spec for It.
WorkOS has introduced auth.md, a new open specification that lets websites host a file at their domain to tell AI agents how to register users, which authentication flows are supported, and how credentials are issued — similar to how robots.txt works for crawlers. Cloudflare, Firecrawl, and Resend have already adopted the protocol.
Background
- WorkOS is a company that provides APIs for enterprise authentication features (SSO, directory sync, etc.) to other apps. This sponsored post proposes auth.md, a new open standard they authored.
- The problem: When an AI agent is acting on behalf of a user and needs to sign up for a service, there's no machine-readable way for it to know how to register. A human can fill out a form; an agent can't.
- auth.md is a plain-text file (like robots.txt) that a service hosts at its domain, listing how AI agents should handle user registration — what OAuth scopes are available, what sign-up flows exist, how credentials are issued.
- Early adopters mentioned: Cloudflare (web infrastructure), Firecrawl (web scraping for AI), and Resend (email API).
- Context: "agentic AI" — where AI doesn't just answer questions but performs actions (booking flights, managing accounts) — is a major push in tech right now, and authentication standards haven't caught up. This is WorkOS positioning itself as the solution.