Agent Auth Protocol is an authentication and authorization protocol that treats an AI agent as a first-class principal. Instead of every tool call appearing to come from the same user token or application token, each agent can receive its own identity, capability grants, lifecycle, and audit trail.
The protocol addresses a practical gap in AI agent deployments. Agents may act on behalf of a user, continue after the user leaves, request new capabilities at runtime, or operate autonomously within constraints. Traditional OAuth-style scopes often describe applications, not individual agent runs or agent identities.
Core concepts include:
- agent registration with a service;
- delegated and autonomous operation modes;
- capability-based grants with constraints;
- approval flows for sensitive access;
- JWT-based request authentication;
- lifecycle controls such as expiry, revocation, and reactivation; and
- service discovery through
/.well-known/agent-configuration.
Agent Auth is complementary to MCP authorization extension and agent policy. Authorization protocols define how access is granted and verified. Policy defines what the application should allow in a given context.
The Agent Auth Protocol documentation describes the protocol as an open-source standard for AI agent authentication, capability-based authorization, and service discovery.
The LLM Knowledge Base is a collection of bite-sized explanations for commonly used terms and abbreviations related to Large Language Models and Generative AI.
It's an educational resource that helps you stay up-to-date with the latest developments in AI research and its applications.