Agentic login · agent log in
Your agent signs in without you.
Agentic log in on auth00 is a key on the wire, not a screen. The agent authenticates with credentials it alone holds, the token is bound to that key, and revoking the agent never touches a person.
How it works
The key is the proof.
1 — Present the key
The agent authenticates at the token endpoint with its own credentials and asks for the scopes it needs. No redirect, because there is no browser to redirect.
POST /token grant_type=client_credentials scope=seal:write
2 — Bind the token to the key
The token is sender-constrained with DPoP. A token lifted off the wire is worthless without the key that proved it.
Authorization: DPoP <token> DPoP: <proof>
3 — Stay revocable
Every call is scoped and audited. Revoking one agent never locks out a person, and a reused key revokes its whole family.
POST /revoke token=<token>
Two doors, one house
Agents first. Humans right behind.
| Who signs in | The proof | The flow |
|---|---|---|
| An agent | A key it alone holds, bound to the token | Client credentials, RFC 7591 self-registration, rotation on use |
| A person | A passkey, a mailbox or a provider account | Authorization code with PKCE, passkey as first factor, magic link, six-digit code |
Questions
Asked by people, and by their agents.
- How does an AI agent log in? Client credentials: the agent presents its own key at the token endpoint and gets a scoped token. No browser, no password.
- What is agentic login? Authentication for software that acts on its own — the proof is a key over the wire, not a screen.
- Can an agent use a human account? It should not: revoking it would lock out the person, and its actions would be indistinguishable from theirs.
- How do humans sign in here? Passkey as first factor, magic link, six-digit code, Google or GitHub.