Anonymous Agent Registration
An agent with no human behind it registers itself, receives a service-signed identity assertion, and exchanges that assertion for an access token using the RFC 7523 JWT bearer grant. The token carries the pre-claim scope because nothing yet proves who runs the agent.
Anonymous Agent Registration
An agent with no human behind it registers itself, receives a service-signed identity assertion, and exchanges that assertion for an access token using the RFC 7523 JWT bearer grant. The token carries the pre-claim scope because nothing yet proves who runs the agent.
Sequence Diagram
Click any step for details
Request
Response
Redirect
Internal
Step-by-Step Breakdown
1
Discover the agent_auth block
Agent → Authorization Server
2
Register at the identity endpoint
Agent → Authorization Server
3
Exchange the assertion for a token
Agent → Authorization Server
4
Access token issued
Authorization Server → Agent
Token Inspector
Specs for this flow
Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.