Documentation
apd is a self-hostable AAuth Agent Provider. It issues short-lived, signed, key-bound identities to AI agents — no API keys and no shared secrets.
Try it without installing anything
A public hosted sandbox runs at
https://sandbox.agentprovider.dev. Enrollment is open, so there is no sign-up
and no credential. Point an agent at it and enroll in one signed request.
curl -s https://sandbox.agentprovider.dev/.well-known/aauth-agent.json
The sandbox is for development only. Its data is ephemeral and is wiped daily. Read the sandbox guide before you rely on it.
Get started
| Guide | For |
|---|---|
| Hosted sandbox | Building against a live provider, with no local setup |
| Install & deploy | Running your own provider |
| Build an agent | Agent developers |
| Protect an MCP server | Resource and MCP server developers |
Enrollment
How an agent proves it may have an identity.
- Overview & patterns — the four methods, and when to use each
- Federated & workload identity — Kubernetes, CI OIDC, SPIFFE, corporate PKI
- Federated: design notes — verification order and policy model
Operate
- Configuration — every field, environment overrides, storage backends
- HTTP API — endpoints, request and response shapes, audit events
- Deploy — TLS, scaling, key rotation, the image and Helm chart
The protocol
Notes behind the implementation.
- Protocol overview
- The Agent Provider role
- HTTP signatures
- Connecting agents
- Resources & MCP
- AAuth Events
Status
apd tracks IETF Internet-Drafts, and AAuth is not a released standard. The provider announces demo mode at runtime. Pin a version, and expect wire changes as the drafts mature.
Current release: 0.4.0 — tracking draft-hardt-oauth-aauth-protocol-11 and
draft-hardt-httpbis-signature-key-08.