# Agent Auth Protocol

> An open protocol that gives each AI agent its own cryptographic identity, granted capabilities, and lifecycle. Agents authenticate with short-lived Ed25519-signed JWTs and execute server-defined capabilities.

## Docs

- [Agents](/docs/agents): An agent is a runtime AI actor with its own identity, capabilities, and lifecycle — the core principal in Agent Auth.
- [Approval Methods](/docs/approval): How user consent works in Agent Auth — device authorization, CIBA, method selection, and the approval object schema.
- [Authentication](/docs/authentication): How hosts and agents authenticate using Ed25519 keypairs, short-lived JWTs, and optional proof-of-possession profiles.
- [Build a server](/docs/build-server): How to add Agent Auth support to your service using the Better Auth plugin — setup, capabilities, OpenAPI adapter, execution, verification, and configuration.
- [Capabilities](/docs/capabilities): Capabilities are the protocol's unit of authorization — server-offered actions that agents request and execute with scoped grants.
- [CLI](/docs/cli): The @auth/agent-cli command-line tool — manage agents, test connections, and script Agent Auth workflows from the terminal.
- [Client SDK](/docs/client-sdk): The @auth/agent TypeScript SDK — embed agent identity, discovery, registration, and capability execution directly in your application.
- [Client](/docs/client): The client sits between the agent and the server, managing keys, discovery, registration, and capability execution.
- [Data Model](/docs/data-model): Field-level reference for the three core data types in Agent Auth — hosts, agents, and agent capability grants.
- [Discovery](/docs/discovery): Discovery is how agents find and connect to services — through well-known endpoints, directories, and direct URL fetching.
- [Errors](/docs/errors): Error format, common error codes, and per-endpoint error codes in the Agent Auth protocol.
- [Host](/docs/host): A host is the persistent identity of the client environment where agents run — representing the place the agent operates from.
- [Agent Auth Protocol](/docs): An implementation-oriented protocol for AI agent identity, registration, and capability access.
- [Integrate the client](/docs/integrate-client): How to integrate the Agent Auth client via SDK, CLI, or MCP server for agent authentication and capability execution.
- [Introduction](/docs/introduction): Agent Auth is an open protocol that gives AI agents their own identity, cryptographic keys, scoped capabilities, and independent lifecycle.
- [MCP Server](/docs/mcp): Run the Agent Auth client as an MCP server — expose protocol tools to AI agents in Claude, Cursor, ChatGPT, and other MCP-compatible hosts.
- [Overview](/docs/overview): Why existing auth has no concept of "agent" and how Agent Auth makes the runtime agent a first-class principal.
- [Privacy](/docs/privacy): Privacy considerations for Agent Auth — host key correlation, agent activity tracking, autonomous agent data, and capability requests as behavioral signals.
- [SDKs](/docs/sdks): Official and community SDKs for the Agent Auth Protocol — TypeScript, Python, and implementation guides for other languages.
- [Security Considerations](/docs/security): Security considerations for implementing and deploying Agent Auth — key management, JWT lifetime, replay protection, and threat mitigations.
- [Server](/docs/servers): The server manages discovery, agent registrations, approvals, capability grants, and JWT verification in the Agent Auth protocol.

## Specification

- [v1.0-draft](/specification/v1.0-draft)