Officielby @AgentAccess

Auth.md Agent Registration Discovery

Trinvise instruktioner til publicering af Auth.md, OAuth Protected Resource Metadata og agentregistrering.

Installation

skills.sh / CLI

Installer denne færdighed direkte i din AI-agent eller projekt.

npx skills add lordavocado/AgentAccess.dk --skill auth-md-discovery

Om Auth.md Agent Registration Discovery

Vejleder AI-kodeagenter i implementeringen af Auth.md — den maskinlæsbare autentificerings-discovery-standard for autonome agenter. Dækker /auth.md som Markdown, OAuth Protected Resource Metadata på /.well-known/oauth-protected-resource, Authorization Server metadata med agent_auth-blokke og understøttelse af identitetsflows (ID-JAG, verificeret e-mail, anonym).

SKILL.md Instruktioner

SKILL.md

De rå trinvise instruktioner som din agent udfører ved aktivering.

---
name: auth-md-discovery
description: Helps a service publish Auth.md support for agent registration. Use when a scanner reports the authMd check is failing or when adding the Auth.md standard to an API or application.
---

# Implement Auth.md Agent Registration Discovery

Helps a service publish Auth.md support for agent registration. Use this when a scanner reports the `authMd` check is failing or when adding the Auth.md standard to an API or application.

## Requirements

- Serve `/auth.md` from the service root as Markdown with an H1 heading that contains `auth.md`.
- Prefer publishing OAuth Protected Resource Metadata at `/.well-known/oauth-protected-resource` for the resource server.
- Include `resource`, `authorization_servers`, `scopes_supported`, and `bearer_methods_supported` with `header` in the PRM document.
- Publish OAuth Authorization Server metadata at each advertised authorization server's `/.well-known/oauth-authorization-server` URL.
- Include a valid `issuer` in Authorization Server metadata and ensure it matches the issuer advertised in PRM.
- Add an `agent_auth` block with `skill`, `register_uri`, and at least one complete registration method when Authorization Server metadata is available.
- If OAuth metadata is not available, keep `/auth.md` self-contained: identify the agent audience, document registration or provisioning endpoint(s), list supported method(s), and explain credential use.

## Flow Metadata

- ID-JAG: include `identity_types_supported: ["identity_assertion"]`, `identity_assertion.assertion_types_supported` with `urn:ietf:params:oauth:token-type:id-jag`, and credential types.
- Verified email: include `identity_assertion.assertion_types_supported` with `verified_email`, credential types, and `claim_uri`.
- Anonymous: include `identity_types_supported: ["anonymous"]`, `anonymous.credential_types_supported`, and `claim_uri`.

## Notes

Do not probe `POST /agent/auth` during passive scans. Registration can create accounts, send email, or issue credentials. Public discovery documents are the safe source of truth.