Skip to content
Methodology

Agent auth readiness

ia.agent-auth-readiness · 5.14

Act SHOULD Scanner data AR-ACT-01

Why it matters

Agents need more than a login page. They need discoverable auth metadata, scoped permissions, PKCE support, and a concise walkthrough that explains how to obtain and use credentials safely.

How to fix it

Support PKCE S256, publish scopes and explain the auth flow in /auth.md.

  1. Add S256 to code_challenge_methods_supported in the OAuth metadata.

  2. List the scopes in scopes_supported.

  3. Explain the flow for agents in /auth.md.

    # Authentication for agents

Use OAuth 2.0 authorization code with PKCE S256. Request the narrowest scope for the task.

Verify

curl -sf https://{domain}/.well-known/oauth-authorization-server | jq -e '.code_challenge_methods_supported | index("S256")'

Expected: exit code 0

Run a new scan for this checkpoint:

isagentready results {domain} --checkpoint ia.agent-auth-readiness
Details Mapping, lifecycle and references
AR mapping
Full match
Score role
Core
Introduced
2026-08-24
Methodology version
2026-10-22

Checkpoint data (JSON)