How does an AI agent sign up to my service for a customer?
Before an agent can sign in to your service for a customer, it needs credentials, and getting them usually means a human filling in a form. auth.md is a short Markdown file at the root of your domain that tells an agent how registration works: which flows you support, which permissions it can ask for and where to go.
What it actually is
It is the "new accounts" desk with a sign written for robots. OAuth explains how to show your pass; auth.md explains how to get a pass in the first place. It is written in Markdown so that people and AI models read the same page, and it points to your OAuth metadata for the machine-precise details.
Why it matters
Agents are starting to act for people across many services at once, and the service that makes registration possible without a human copying keys around is the one an agent can actually use. For a product that wants to be picked by assistants, a documented way to register is the first step of every integration.
What good looks like
A real auth.md at the root of your domain that describes your registration flows, the scopes an agent may request and the endpoints involved, published alongside protected-resource metadata that agrees with it.
Being honest about it
This is an Advanced check: it never fails a page and stays out of your headline score. The protocol was published by WorkOS in May 2026 and is backed by a short list of agent-focused companies, so it is a forward-looking signal, not something most sites are expected to have. If your service has no accounts or API, a warning here is the expected result.
Where most sites go wrong
The common false alarm is a documentation site that answers any address ending in .md with a "page not found" written in Markdown, which looks like a file and is not one. The other is a placeholder auth.md with a heading and nothing else, published to satisfy a checklist rather than to help an agent.
On the web
State of the Web · November 2026In November 2026, <1% of the sites we could read passed the “Auth.md agent registration” check.
On the sites scanned in both October 2026 and November 2026, it stayed at 5%.
The month-by-month line counts the sites scanned in each calendar month, so it can differ from the figure above, which uses each site’s latest scan from the last three months.
Not enough history yet.
Based on the sites Bot Appétit has scanned. Most of these sites come from lists we scan for research. Not a random sample of the web.
Not sure where yours stands?
A free scan checks this and everything else in about 20 seconds — no signup. Or if it's already flagged and you'd rather it were simply handled, we do that too.
Flagged for this one? We handle it. No pitch, just a plain-English chat.
Book a call