Human attention is finite. Agent attention is exploding. AFAuth is the open protocol that makes AI agents first-class citizens of every service.
AI agents sign themselves up to AFAuth-supporting services automatically — with their own cryptographic identity, no human in the loop. Your agent reaches every service that exists. Your service reaches every agent that exists. Both sides multiply each other.
Every request is signed per RFC 9421 (HTTP Message Signatures) — no passwords to share, no bearer tokens, no client_id-style developer registration. Time to make agents first-class users of your service.
| Repo | What it is |
|---|---|
spec |
The normative protocol specification, JSON schemas, and Appendix C test vectors. Start here. |
cli |
Reference command-line interface in Go. Generate a keypair, signed-call any AFAuth service, and run the conformance probe against a deployment. |
typescript-sdk |
Reference TypeScript SDK published as @afauthhq/*. Composable agent / server / Cloudflare Worker packages. |
# Service side — install the alpha SDK
npm i @afauthhq/server@alpha
# Agent side — pre-built CLI binaries on the releases page:
# https://github.com/AFAuthHQ/cli/releases/latestThe CLI's afauth probe command runs the full §-level conformance harness against any AFAuth service, including yours under development.
v0.1 — alpha. The protocol is feature-complete for the v0.1 milestone (signature verification, owner-invitation + claim ceremony, pre-claim key rotation, owner-initiated revocation, attestation, rate-limit envelope). The spec is still a working draft and packages are tagged alpha — breaking changes are possible until v0.1 is finalised.
- Protocol questions, ambiguities, and proposals:
spec/issues. - Implementation bugs: file in the relevant implementation repo.
- New ideas live as AFAuth Protocol Proposals (AFAPs) under
spec/proposals/.
Please report vulnerabilities privately — see SECURITY.md. Do not open public issues for security-sensitive findings.
- Specification text — CC-BY-4.0.
- Code-shaped artefacts (test vectors, JSON schemas, reference implementations) — Apache-2.0 for spec-repo code, MIT for the CLI and SDKs.
Dual-licensing follows standard protocol-repo practice (IETF, OpenSSF, CNCF working groups).