Authentication

Summary

Authentication covers how agents receive credentials, prove identity, narrow authority, and call protected APIs or MCP servers without borrowing a human browser session.

• Owns: API keys, OAuth for agents, token exchange, DPoP, agent identity, MCP auth metadata, auth.md, and replay protection.
• Does not own: tool safety semantics; see Tool Design. Public discovery broadly; see Discovery.
• Agent-ready means: credentials are scoped, short-lived where possible, machine-usable at runtime, validated on every request, and auditable by agent/user/delegation chain.

Registration can still involve human consent or an OTP claim ceremony. The runtime request path should stay programmatic: no CAPTCHA, login page, or ambient session cookie dependency.

Choose A Path

1. API Keys - Only when keys are scoped, rotatable, and not exposed to models.
2. OAuth 2.1 for Agents - Default for standalone agent services and machine-to-machine access.
3. Agent Identity - Model agents as first-class principals for audit trails.
4. Token Exchange - Narrow authority for delegation and sub-agents.
5. DPoP - Bind tokens to client keys to reduce replay risk.
6. Protected Resource Metadata - Publish OAuth metadata for protected APIs.
7. MCP Authorization - Apply OAuth discovery and client identity to MCP.
8. auth.md - Describe agentic registration and credential-claim flows.
9. Idempotency and Replay Protection - Defend write operations from duplicated or replayed requests.
10. Auth Anti-Patterns - Avoid browser sessions, unscoped tokens, and hidden delegation.

Related

1. API Surface - Contracts that declare which authenticated operations exist.
2. MCP Servers: Authentication - Implementing auth inside MCP servers.
3. Discovery: Well-Known Endpoints - Publish metadata endpoints agents can discover.
4. Error Handling - Return structured auth failures agents can interpret.