Agent Auth is a set of open-source implementations of the Agent Auth Protocol, which covers authentication, capability-based authorization, and service discovery for AI agents that connect to a product. Agents discover a service, register with a cryptographic identity, request capabilities, and run them, while sensitive actions stay behind user approval.
The protocol treats each runtime agent as its own principal instead of letting all agents share one user token. Each agent gets its own identity, scoped capabilities with constraints (for example a transfer capability capped at an amount and currency), and a lifecycle the server controls, so a server can see which agent is acting and revoke one without affecting the others. It addresses delegated agents acting for a user, autonomous agents with no user in the loop (a user can link to the agent later and take over governance), and discovery through a well-known endpoint and a directory.
| Package | Role |
|---|---|
| @better-auth/agent-auth | Better Auth server plugin |
| @auth/agent | Client SDK for agent runtimes |
| @auth/agent-cli | CLI and MCP server |
Next.js reference apps show the Better Auth plugin with Drizzle, including variants with WebAuthn passkeys enabled. Adapters turn existing OpenAPI or MCP tools into an Agent Auth server.
Features
- Per-agent identity: each agent registers with its own cryptographic identity instead of sharing a user token
- Capability-based authorization: agents request specific capabilities with constraints such as amount limits or rate limits
- User approval: sensitive actions require approval from the user
- Lifecycle control: the server audits each agent and can terminate one without affecting others
- Autonomous registration: agents with no user in the loop can register directly, and a user can claim them later
- Service discovery: a well-known endpoint and a directory let agents find services by URL or by a natural-language description
- Better Auth plugin: server-side implementation as a Better Auth plugin
- Client SDK and CLI: an SDK for agent runtimes plus a CLI that also runs as an MCP server