---
title: "auth.md — One week later: who's shipped, who's writing, what's next"
description: "A week after we shipped auth.md, developers have published spec-compliant files, partners have endorsed it, and the ecosystem is aligning."
url: https://workos.com/blog/auth-md-one-week-later
published: "May 28, 2026"
---

# auth.md — One week later: who's shipped, who's writing, what's next

It's been a week since we proposed `auth.md`, and the response went past discussion. People shipped it. Spec-compliant `auth.md` files appeared on real domains within hours, the launch partners who helped build the demo posted their own takes, and a widening circle of agent and identity tools started converging on the same primitive.

This is what week one looks like when an idea has a small enough surface that anyone can implement it.

![IMAGE: A dark terminal-style background with a single document-shaped node centered, rendered with a subtle markdown chevron motif and a small key glyph. Teal and soft amber accents, no text, OG-friendly composition.](https://cdn.prod.website-files.com/621f84dc15b5ed16dc85a18a/6a1894d50cfddf96a1899a1f_img-0-1779988856901.png)

## A quick refresher

If you missed it, [we introduced auth.md last week](https://workos.com/blog/agent-registration-with-auth-md) as an open protocol that tells an agent how to register for a service on a user's behalf. You publish a single Markdown file at `yourapp.com/auth.md`, and an agent reads it the same way it already reads `llms.txt` or `agents.md` — no registry to join, no marketplace to list in, no proprietary SDK to adopt.

The file points at the endpoints an agent needs to obtain credentials, and the rest is standard OAuth.

## Get started with auth.md

Read about the spec and get started quickly at [auth.md.](https://workos.com/auth-md)

Read about [how we kicked it off at MCP Night 4](https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration)

Check out the official [workos/auth.md repo](https://github.com/workos/auth.md).

## Companies that already shipped an auth.md

The clearest signal that a protocol is real is that people put it on their own domains. Many well known companies did on week one.

Brendan Irvine-Broque from Cloudflare laid out exactly which pieces are usable today — Protected Resource Metadata, `WWW-Authenticate` on a 401, ID-JAG, and `auth.md` — with no registry or marketplace required, an openness that comes straight from [the design choices behind composing existing OAuth standards](https://workos.com/blog/agent-registration-with-auth-md) instead of inventing new ones.

> anyone can start using [https://t.co/5V96pwbspi](https://t.co/5V96pwbspi) today — don't need to ask for permission or be part of any registry or marketplace
>
> - .well-known/oauth-protected-resource URI
> - returning WWW-Authenticate header on 401
> - ID-JAG
> - auth.md as a way to steer agents towards using… [https://t.co/bMVh9QmFyu](https://t.co/bMVh9QmFyu)
>
> — Brendan Irvine-Broque (@irvinebroque) [May 22, 2026](https://x.com/irvinebroque/status/2057893376113226185?ref_src=twsrc%5Etfw)

Resend builds agent-first email services for developers.

> 💥 [https://t.co/IxJEKQsklH](https://t.co/IxJEKQsklH) [https://t.co/dDKw40PAHG](https://t.co/dDKw40PAHG)
>
> — Zeno Rocha (@zenorocha) [May 22, 2026](https://x.com/zenorocha/status/2057939650514203058?ref_src=twsrc%5Etfw)

Firecrawl, a launch partner on the original demo, backed it on day one.

> Happy to be a partner with WorkOS on auth.md! [https://t.co/8rRIQxfWCJ](https://t.co/8rRIQxfWCJ)
>
> — Firecrawl (@firecrawl) [May 22, 2026](https://x.com/firecrawl/status/2057912500482609347?ref_src=twsrc%5Etfw)

NanoGPT was one of the first AI products to ship a spec-compliant `auth.md`, served under `/.well-known`.

> NanoGPT now exposes auth.md plus agent auth discovery metadata under /.well-known for agent and API clients.
>
> This makes it easier for tools/agents to discover NanoGPT authentication, capabilities, and device-login flows automatically.
>
> — Nano-GPT (@NanoGPTcom) [May 28, 2026](https://x.com/NanoGPTcom/status/2059996865337188644?ref_src=twsrc%5Etfw)

WebClaw put agent discovery, `auth.md`, an OAuth device flow, and MCP behind one front door, live at `webclaw.io/auth.md`.

> AI agents can onboard themselves.
>
> webclaw exposes agent discovery, auth.md, OAuth device flow, MCP, API catalog, OpenAPI, and structured web extraction, so agents can discover, authenticate, scrape, crawl, and extract without a human wiring every step.[https://t.co/pYKADasANG](https://t.co/pYKADasANG) [https://t.co/mgbZCUYSSE](https://t.co/mgbZCUYSSE)
>
> — WebClaw (@webclaw_io) [May 23, 2026](https://x.com/webclaw_io/status/2058148640078659646?ref_src=twsrc%5Etfw)

Zuplo offers API management services and tools and did a full write up of the auth.md spec.

> Your agent needs API keys from fifteen services. Every one requires a human to sign up first.
>
> auth.md standardises how agents register for credentials on a user's behalf: [https://t.co/SiEzhysiSg](https://t.co/SiEzhysiSg)
>
> — Zuplo (@Zuplo) [May 29, 2026](https://x.com/Zuplo/status/2060377887484547254?ref_src=twsrc%5Etfw)

Headless Domains added an `auth.md` and wrote up the integration as its own launch.

> Discovery is step one.
>
> Authorization is where agents become real participants.
>
> Headless Domains added auth.md so agents can move from finding a service to registering, authenticating, and operating with a trusted identity.
>
> Read more in the comments ↓ [pic.twitter.com/GMvbq2eYtp](https://t.co/GMvbq2eYtp)
>
> — Headless Domains (@HeadlessDomains) [May 27, 2026](https://x.com/HeadlessDomains/status/2059682695169663436?ref_src=twsrc%5Etfw)

## What the ecosystem is saying

The endorsements that matter most came from the people building adjacent infrastructure — the ones who would have to live with the protocol if it caught on.

Liad Yosef from Ora.ai called it a milestone for the agent web.

> This is one of the most important milestones for the agentic web. Amazing work by [@WorkOS](https://x.com/WorkOS?ref_src=twsrc%5Etfw) and the partners on this. ✨
>
> And - auth.md spec-compliance checks are already added to the agentic readiness scorecard at [https://t.co/KHNCBhSRGC](https://t.co/KHNCBhSRGC) ! [https://t.co/bcHB0pFg99](https://t.co/bcHB0pFg99) [pic.twitter.com/HNW4zYAmwU](https://t.co/HNW4zYAmwU)
>
> — Liad Yosef (@liadyosef) [May 22, 2026](https://x.com/liadyosef/status/2057907918431736262?ref_src=twsrc%5Etfw)

Ora followed by shipping `auth.md` spec-compliance checks into its readiness scorecard and writing up [a technical deep dive of why auth.md is critical.](https://ora.ai/blog/deep-scan-v1-2)

> The internet was built around humans.
> Next layer will be built around agents.
>
> Standards like auth.md are part of what turns the agentic web from idea into infrastructure.
>
> Auth.md spec compliance checks are ALREADY in [https://t.co/4uqQVHeHBK](https://t.co/4uqQVHeHBK).✨ [https://t.co/57h3LxTtwH](https://t.co/57h3LxTtwH)
>
> — ora (@oradotai) [May 22, 2026](https://x.com/oradotai/status/2057920291221692644?ref_src=twsrc%5Etfw)

Julian Weisser placed `auth.md` alongside the week's biggest founder stories.

> Two huge stories from solo founders today:
>
> 1/ [@Bencera](https://x.com/Bencera?ref_src=twsrc%5Etfw) announced $30M raise for Polsia (and approaching $10M annual run rate)
>
> 2/ [@grinich](https://x.com/grinich?ref_src=twsrc%5Etfw) announced the WorkOS launch of auth.md: open protocol for agents to register for services on the web [pic.twitter.com/2tVfBZPkPT](https://t.co/2tVfBZPkPT)
>
> — weisser (@julianweisser) [May 23, 2026](https://x.com/julianweisser/status/2058071334119506329?ref_src=twsrc%5Etfw)

Adi Singh, founder of AgentMail is digging into auth.md.

> Our full demo from WorkOS!
>
> Excited to dive into auth.md today - such a legendary team full of standup people. [@grinich](https://x.com/grinich?ref_src=twsrc%5Etfw) [@stephenmruiz](https://x.com/stephenmruiz?ref_src=twsrc%5Etfw) [https://t.co/W7pPRk3UZh](https://t.co/W7pPRk3UZh)
>
> — Adi Singh (@adisingh) [May 28, 2026](https://x.com/adisingh/status/2060059784389509204?ref_src=twsrc%5Etfw)

## What the builder community is saying

Nate Davis shipped lurkers.ntedvs.com, an indie demo — a feed only agents can read, gated entirely by `auth.md`.

> I built a feed for agents only. It uses auth.md from [@WorkOS](https://x.com/WorkOS?ref_src=twsrc%5Etfw) to authenticate agents and [@Cloudflare](https://x.com/Cloudflare?ref_src=twsrc%5Etfw) for hosting and a database. Have a visit and let your agent speak it's mind! [https://t.co/7qZoEHvZpC](https://t.co/7qZoEHvZpC) [https://t.co/cDmn35JBlg](https://t.co/cDmn35JBlg)
>
> — Nate Davis (@ntedvs) [May 24, 2026](https://x.com/ntedvs/status/2058422056362901714?ref_src=twsrc%5Etfw)

> Los agentes de IA ya tienen su propio protocolo de registro.
>
> Se llama auth.md.
>
> En vez de pelear con formularios, emails y CAPTCHAs, ahora pueden registrarse de forma nativa y estructurada solo leyendo un archivo en tu dominio.
>
> REPOOO👇 [pic.twitter.com/goOihy3JfT](https://t.co/goOihy3JfT)
>
> — Erick (@ErickSky) [May 22, 2026](https://x.com/ErickSky/status/2057970442518860208?ref_src=twsrc%5Etfw)

> AI agents are hitting a hard wall: human-centric authentication.
>
> To fix this, WorkOS, Cloudflare, and Firecrawl just proposed auth.md. It’s an open protocol allowing services to publish agent-readable registration instructions via a Markdown file.
>
> Instead of hacking ways around… [pic.twitter.com/kCXCwVAvAN](https://t.co/kCXCwVAvAN)
>
> — Agentic AI Foundation (@AgenticAIFdn) [May 29, 2026](https://x.com/AgenticAIFdn/status/2060345513476571172?ref_src=twsrc%5Etfw)

> auth.md is a new open protocol that gives agents a standard way to register with an API on a user's behalf, no human filling out a signup form. Here's how it works and why it matters.[https://t.co/5rr49TjuXW](https://t.co/5rr49TjuXW)
>
> — Mark 🇺🇳 (@mcraddock) [May 29, 2026](https://x.com/mcraddock/status/2060272213664702512?ref_src=twsrc%5Etfw)

> Added auth.md to:[https://t.co/N7JJyFx77K](https://t.co/N7JJyFx77K) 🥳
> Along agent-auth and Oauth 2.0 [https://t.co/yMix4snz6t](https://t.co/yMix4snz6t)
>
> — hsolo (@hsologarcia) [May 22, 2026](https://x.com/hsologarcia/status/2057962132390412514?ref_src=twsrc%5Etfw)

## The one-liner everyone's repeating

Moritz Petersen reduced the whole thing to a single line, and that's the version people keep resharing.

> auth.md — the /sign-up for agents 🤖 [https://t.co/8RqMq8CVSW](https://t.co/8RqMq8CVSW)
>
> — Moritz Petersen (@moritzpetersen) [May 22, 2026](https://x.com/moritzpetersen/status/2057887092072484910?ref_src=twsrc%5Etfw)

## What's next

There's no roadmap to wait on. The spec is open and the implementation surface is deliberately small: publish the file, expose Protected Resource Metadata, return `WWW-Authenticate` on a 401, accept a POST at your registration endpoint, and issue a credential. That's the entire loop, and you can stand it up this week.

Further reading: [read the original launch post](https://workos.com/blog/agent-registration-with-auth-md) for the full design rationale, [revisit the MCP Night 4 recap](https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration) for where the idea started, browse the [spec and getting-started guides](https://workos.com/auth-md), or clone the [reference implementation](https://github.com/workos/auth.md). When you ship yours, email us at `authmd@workos.com` and we'll add you to the list.