AAuth

AAuth is an HTTP authorization protocol for agents that access resources on a person’s behalf. It gives each agent instance a cryptographic identity and uses signed requests and key-bound tokens so a copied token cannot be used alone. The protocol specification is an individual Internet-Draft and a work in progress.

Dick Hardt, an author of OAuth 2.0, began developing AAuth with others in the identity community after implementing authorization for an MCP server. The project addresses agents that discover services and need permissions while a task is underway. AAuth is designed to coexist with OAuth and OpenID Connect.

Identity and access

An agent signs requests with its own key, and an agent token binds that key to its identifier. A resource can decide access from the agent’s identity alone or manage authorization through its own login and consent flow. Other modes introduce a person server, which represents the person and can issue identity or authorization tokens; federated authorization also involves an access server that applies the resource’s policy.

The draft defines five access modes and allows a resource to use different modes for different endpoints. A person token identifies whom the agent acts for, while an auth token carries an authorization grant. When a resource requires authorization, it can issue a signed resource token describing the requested access; the agent takes that token to its person server for a decision.

Missions and developer tools

Optional missions give the person server context for supervising work across resource requests. An agent proposes a mission for approval, and the person server can evaluate later requests against its intent and the accumulated log. The draft also describes permission checks, audit records and clarification during consent. Tool pre-approval records what the person agreed to, though the protocol itself does not enforce local tool use.

Developers can inspect flows in the Protocol Explorer and use the TypeScript packages to add signed requests and token handling to agents and resources. The packages include a CLI for authenticated HTTP requests; their documented limitations include call chaining and four-party access-server federation.