---
agent_auth:
  skill: https://anter.ai/.well-known/agent-skills/anter-managed-agents/SKILL.md
  register_uri: https://api.anter.ai/v1/auth/agent/register
  supported_identity_types:
    - agent
    - user_delegated
    - service_account
    - anonymous
    - identity_assertion
  identity_types_supported:
    - agent
    - user_delegated
    - service_account
    - anonymous
    - identity_assertion
  credential_types:
    - bearer_token
    - api_key
    - mtls
    - oauth2_client_credentials
  credential_types_supported:
    - bearer_token
    - api_key
    - mtls
    - oauth2_client_credentials
  identity_assertion:
    assertion_types_supported:
      - urn:ietf:params:oauth:token-type:id-jag
      - verified_email
  claim_uri: https://api.anter.ai/v1/auth/agent/claim
  claim_url: https://api.anter.ai/v1/auth/agent/claim
  revocation_uri: https://api.anter.ai/v1/auth/agent/revoke
  revocation_url: https://api.anter.ai/v1/auth/agent/revoke
---

# Anter auth.md — Agent Authentication & Registration Protocol

This document describes how automated AI agents discover authentication endpoints, register identities, and obtain API authorization for Anter services.

## Overview

Anter supports programmatic agent registration, user-delegated auth, and service account tokens. Agents can authenticate using OAuth 2.0 Client Credentials, API Keys, or Bearer Access Tokens.

## Discovery Metadata

- **OAuth Protected Resource Metadata (RFC 9728):** `https://anter.ai/.well-known/oauth-protected-resource`
- **OAuth 2.0 Authorization Server (RFC 8414):** `https://anter.ai/.well-known/oauth-authorization-server`
- **OpenID Connect Discovery:** `https://anter.ai/.well-known/openid-configuration`
- **API Catalog (RFC 9727):** `https://anter.ai/.well-known/api-catalog`

## Agent Registration Protocol

### 1. Programmatic Agent Registration

Submit a POST request to register an AI agent:

```http
POST https://api.anter.ai/v1/auth/agent/register HTTP/1.1
Content-Type: application/json

{
  "client_name": "MyAutonomousAgent",
  "identity_type": "agent",
  "grant_types": ["client_credentials", "urn:ietf:params:oauth:grant-type:token-exchange"],
  "scopes": ["agents:read", "agents:write", "mcp:access", "tools:execute"]
}
```

**Response (201 Created):**

```json
{
  "client_id": "agent_cl_98127341",
  "client_secret": "sec_8f91a2b3c4d5e6f7a8b9c0d1e2f3a4b5",
  "credential_type": "oauth2_client_credentials",
  "token_endpoint": "https://api.anter.ai/v1/oauth/token",
  "scopes_granted": ["agents:read", "agents:write", "mcp:access", "tools:execute"]
}
```

### 2. Obtaining Bearer Tokens

Using Client Credentials:

```http
POST https://api.anter.ai/v1/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=agent_cl_98127341
&client_secret=sec_8f91a2b3c4d5e6f7a8b9c0d1e2f3a4b5
&scope=agents:read%20agents:write%20mcp:access
```

**Response (200 OK):**

```json
{
  "access_token": "anter_at_a1b2c3d4e5f6...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "agents:read agents:write mcp:access"
}
```

### 3. API Key Authentication

Include your API Key in incoming requests:

```http
GET https://api.anter.ai/v1/agents HTTP/1.1
Authorization: Bearer anter_ak_987123654
x-api-key: anter_ak_987123654
```

### 4. Claim & Revocation Endpoints

- **Claim Agent Identity:** `POST https://api.anter.ai/v1/auth/agent/claim`
- **Revoke Token / Credential:** `POST https://api.anter.ai/v1/auth/agent/revoke`