auth-md

Community implementation, not affiliated with WorkOS.

Minimal helpers for the auth.md agent-registration protocol.

Early release (0.1.0). Tracks the workos/auth.md agent-services guide as of October 2026. The spec is still evolving.

pip install auth-md

Includes protected_resource_metadata, authorization_server_metadata, www_authenticate, generate_auth_md, and verify_id_jag (trust list, audience, typ, asymmetric algorithms only, client_id, verified email or phone, auth_time freshness, jti replay protection).

from auth_md import verify_id_jag, MemoryJtiStore

identity = verify_id_jag(
    assertion,
    audience="https://auth.yourapp.com",
    trusted_issuers={"https://provider.example": {"display_name": "Provider"}},
    jti_store=MemoryJtiStore(),  # use Redis or a DB table in production
)

Never bind a verified ID-JAG to an existing account by email alone; the spec requires a first-link step-up.

MIT licensed.