Manage Auth.md

Use this skill when adding or updating the Agentic Registration Discovery file (/auth.md) to comply with WorkOS and isitagentready.com standards. The auth.md file is a human and machine-readable document that declares an application's agent registration endpoints, OAuth authorization metadata locations, and agentic compliance posture.

Core Rules

• The file MUST begin exactly with the H1 heading # Auth.md on the first line of the document body. Do not use variations like # Authentication, # auth, or ## Auth.md.
• The file MUST document the registration endpoints explicitly (e.g., POST /agent/identity).
• The phrase "agentic registration" MUST appear in the document body.
• The file MUST be served publicly at /auth.md from the domain root (e.g., https://example.com/auth.md).
• Link to the OAuth authorization metadata endpoints using exact URLs — do not use relative paths.
• Do not embed credentials, secrets, or tokens in auth.md. Only reference public endpoint paths.
• Treat auth.md as a public, signed contract: do not include internal-only registration endpoints or unreleased callback URLs
• Validate the file against the current scanner rule set before every deploy; reject schema-drifted files (OWASP ASI04)
• Every registration endpoint URL must be on the operator's own domain; reject third-party URLs at code review
• Run a curl check from outside the cache to confirm the deployed content matches the source after each change

When to Use