# auth00

> Identity for humans and for agents. A person signs in with a passkey, a magic
> link or a six-digit code. An agent registers itself, holds its own key and gets
> a scoped token — no browser, no password, no human in the loop.

auth00 is an OAuth 2.1 / OpenID Connect provider. It is multi-tenant: every
customer gets its own door on its own subdomain, with its own brand.

## What an agent can do here

- **Agentic sign up / agent account creation** — dynamic client registration
  (RFC 7591). The agent POSTs its own metadata and receives a `client_id` and a
  secret only it holds. See https://auth00.co/agent-sign-up/
- **Agentic login / agent log in** — OAuth 2.1 `client_credentials`. The token is
  sender-constrained with DPoP, so a token without its key is worthless.
  See https://auth00.co/agentic-log-in/
- **Rotation** — keys rotate on use. A key presented twice revokes its whole
  family, so a copied key stops working the moment the original is used.
- **Separation** — an agent client cannot use the interactive human flow, and a
  human account is never revoked when an agent is.

## What a human can do here

- Passkey as first factor (WebAuthn, discoverable credentials — no username)
- Magic link and six-digit code by email, valid five minutes
- Google and GitHub
- Every method available in every design; the tenant chooses.

## Beyond the door

- **Agent trust protocol (AATP)** — an agent service is measured against a
  profile and receives a signed, revocable certificate. "May I trust this thing"
  is answered by a measurement, not a promise.
- **Digital signature and anchored proof** — a seal travels with the file, joins
  a chain that cannot be rewritten afterwards, and verifies without an account.
- **Identity verification in your own brand** — ID document plus a live selfie,
  about a minute, on your domain. The customer never sees a third party.

## Endpoints

- Issuer: https://login.auth00.co
- Discovery: https://login.auth00.co/.well-known/openid-configuration
- Token: https://login.auth00.co/token
- Dynamic client registration: https://login.auth00.co/register
- Passkey as first factor: POST /login/passkey/options, POST /login/passkey/verify

## Pages

- https://auth00.co/agent-sign-up/ — agent sign-up, agentic sign up, agent account creation
- https://auth00.co/agentic-log-in/ — agentic login, agent login, machine authentication
- https://auth00.co/ai/ — what changes when the visitor is not a person
- https://auth00.co/why/ — a login proves who, a seal proves what
- https://auth00.co/trust/ — how the proof holds up
- https://auth00.co/verify/ — check a file without uploading it