Auth.md and OAuth Metadata
Auth.md and OAuth metadata help AI agents understand authentication, authorization servers, protected resources, scopes, and consent boundaries.
Auth.md and OAuth Metadata
Auth.md is an emerging convention for documenting how AI agents should authenticate with a website or service. OAuth metadata is the standardized layer that tells clients where authorization servers, token endpoints, protected resources, scopes, and issuer information live.
For agent-ready websites, the important principle is simple: do not make agents guess your auth model.
What to Document
- Whether public resources require no auth
- Which workflows require user consent
- OAuth authorization server metadata
- Protected resource metadata
- Supported scopes
- Token audience and issuer expectations
- Human support or security contact
SEO and Product Guidance
Authentication metadata matters when agents move beyond reading pages and start acting for users. A product website may let an agent retrieve invoices, compare plans, open a support ticket, or start checkout. Those workflows need explicit consent and clear boundaries.
Keep public content public. Keep private workflows behind user-approved auth.