Authentication

Agent identity is provided by WorkOS AuthKit. The authorisation server and scopes are published in /.well-known/oauth-protected-resource (RFC 9728); step-by-step commands are in /auth.md.

Steps

1. Reuse a registration if you have one. Do not register again for every task.
2. Register. anonymous needs no email and grants waitlist:write and survey:write at once. service_auth takes the person's email and needs the claim step.
3. Claim (for service_auth; optional for anonymous). You give the person a link; they sign in and read you a code; you complete the claim with it. Their identity is then attached to your token, and submissions are trusted.
4. Exchange the registration's assertion for an access token (grant_type JWT bearer) at the authorisation server's token endpoint.

Store secrets in the operating system's credential store and never print them.

Using the token

Send Authorization: Bearer <token>.

• No token: 401 with a WWW-Authenticate header pointing to the protected resource metadata.
• Valid token without the scope: 403.
• Expired token: exchange the assertion again; if the assertion has expired too, register again.

Scopes