Metadata-Version: 2.4
Name: auth-md
Version: 0.1.0
Summary: Minimal helpers for the auth.md agent-registration protocol: discovery metadata, auth.md generation, and ID-JAG verification.
License: MIT
Keywords: auth.md,auth-md,agent-auth,ai-agents,id-jag,oauth,agent-registration
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: pyjwt[crypto]>=2.6
Dynamic: license-file

# auth-md

_Community implementation, not affiliated with WorkOS._

Minimal helpers for the [auth.md](https://github.com/workos/auth.md) agent-registration protocol.

> Early release (0.1.0). Tracks the workos/auth.md agent-services guide as of October 2026. The spec is still evolving.

```sh
pip install auth-md
```

Includes `protected_resource_metadata`, `authorization_server_metadata`, `www_authenticate`, `generate_auth_md`, and `verify_id_jag` (trust list, audience, `typ`, asymmetric algorithms only, `client_id`, verified email or phone, `auth_time` freshness, `jti` replay protection).

```python
from auth_md import verify_id_jag, MemoryJtiStore

identity = verify_id_jag(
    assertion,
    audience="https://auth.yourapp.com",
    trusted_issuers={"https://provider.example": {"display_name": "Provider"}},
    jti_store=MemoryJtiStore(),  # use Redis or a DB table in production
)
```

Never bind a verified ID-JAG to an existing account by email alone; the spec requires a first-link step-up.

MIT licensed.
