# Who’s on First

> A field guide to agent authentication and authorization: the flows, the deployments and the standards, with and without a human in the loop.

Who’s on First (whosonfirst.ai) is an independent reference, not a specification. It explains how software agents authenticate and how they are authorized: who is acting, for whom, and who said they could. Standards in this area change monthly; every page carries the month it was last checked against its sources, and links to them.

Standards status last reviewed November 2026. Drafts move quickly: check the linked source before you build on one.

Each link below is the Markdown form of a page on the site. The same address without `index.md` is the page itself, and is the one to cite. All of the pages in one file: https://whosonfirst.ai/llms-full.txt

## Start here

- [Who’s on First](https://whosonfirst.ai/index.md): A field guide to agent authentication and authorization: the flows, the deployments and the standards, with and without a human in the loop.
- [Concepts in agent authentication and authorization](https://whosonfirst.ai/concepts/index.md): The ideas behind agent authentication and authorization: principals, delegation versus impersonation, audience, proof of possession, and what each claim in a token is for.
- [Choose an authorization flow for your agent](https://whosonfirst.ai/guide/index.md): Answer six questions about your agent and get the authentication and authorization flows that fit, with reasons.
- [Learn agent authentication and authorization from the start](https://whosonfirst.ai/learn/index.md): 6 short lessons on how AI agents get access: what an API can see, what a token is, how an agent gets one, and what limits the damage. No OAuth knowledge needed.

## Lessons

- [What does the API actually see?](https://whosonfirst.ai/learn/what-the-api-sees/index.md): Say what an API can and cannot know about a request from an agent, and why an API key is not enough.
- [What is a token?](https://whosonfirst.ai/learn/tokens/index.md): Read an access token, name the five checks an API runs before believing it, and say what a valid token still does not prove.
- [How does an agent get a token for a user?](https://whosonfirst.ai/learn/getting-a-token/index.md): Explain each hop of an OAuth sign-in: why the browser is involved, why a code comes back before a token, and what a refresh token is for.
- [What if nobody is there to sign in?](https://whosonfirst.ai/learn/whose-authority/index.md): Decide whether an agent should act for a person or as itself, and say where an agent’s own identity comes from.
- [What happens when the agent calls a tool that calls an API?](https://whosonfirst.ai/learn/chains/index.md): Explain why a token should be exchanged at each hop and not passed along, and tell delegation from impersonation.
- [What limits the damage when something goes wrong?](https://whosonfirst.ai/learn/limits/index.md): Name the two failures every agent design has to plan for, and the controls that limit each.

## Flows

- [Agent authentication and authorization flows](https://whosonfirst.ai/flows/index.md): Step-by-step interactive walkthroughs of every way an AI agent can authenticate and be authorized, from OAuth with a human at the keyboard to workload identity with no human at all.
- [Authorization code with PKCE](https://whosonfirst.ai/flows/authorization-code-pkce/index.md): The baseline. A person signs in, approves specific scopes, and the agent receives a token that says so.
- [MCP authorization](https://whosonfirst.ai/flows/mcp-authorization/index.md): How an MCP client that has never seen a server before discovers where to sign in, identifies itself, and gets a token good for that server alone.
- [Client credentials](https://whosonfirst.ai/flows/client-credentials/index.md): The agent authenticates as itself. No user, no consent screen, no one to ask.
- [Workload identity federation](https://whosonfirst.ai/flows/workload-identity-federation/index.md): Your agent uses an identity established by its runtime to obtain short-lived access from a system that trusts that identity.
- [Token exchange (on-behalf-of)](https://whosonfirst.ai/flows/token-exchange/index.md): Trade the token you were given for a new one that names both the user and the service now acting for them.
- [Sender-constrained tokens (DPoP)](https://whosonfirst.ai/flows/dpop/index.md): Bind a token to a key so that stealing the token is not enough to use it.
- [Device authorization grant](https://whosonfirst.ai/flows/device-authorization/index.md): For agents with no browser of their own: show a code, let the person approve on another device, and poll.
- [Step-up and transaction-specific consent](https://whosonfirst.ai/flows/step-up-authorization/index.md): Start with a weak token. When the agent reaches something sensitive, the API says so and the user is asked for exactly that.
- [Backchannel approval (CIBA)](https://whosonfirst.ai/flows/ciba/index.md): The agent asks the authorization server to go and find the user. Approval arrives as a push notification, not a redirect.
- [Out-of-band authorization (MCP URL elicitation)](https://whosonfirst.ai/flows/url-elicitation/index.md): A tool needs the user to sign in somewhere else. It hands back a link, the user completes the flow in a browser, and the secret never touches the agent.
- [Signed agent requests with a person server (AAuth)](https://whosonfirst.ai/flows/aauth/index.md): The agent has a key of its own and signs every request. A server the user chose tells the API who the agent acts for and what they approved.
- [Enterprise-managed authorization (ID-JAG)](https://whosonfirst.ai/flows/cross-app-access/index.md): The company identity provider decides which agents may reach which apps for which employees. No per-app consent screens.
- [Identity chaining across domains](https://whosonfirst.ai/flows/identity-chaining/index.md): Carry who-is-this-for across an organizational boundary, with each side keeping control of its own tokens.
- [Transaction tokens](https://whosonfirst.ai/flows/transaction-tokens/index.md): Inside your own infrastructure, replace the access token with a short-lived token that pins down one transaction and travels the whole call chain.
- [SPIFFE identities and mutual TLS](https://whosonfirst.ai/flows/spiffe-workload-identity/index.md): Every agent process gets a cryptographic identity from the infrastructure it runs on, and uses it to authenticate both ends of every connection.
- [Workload identity tokens with proof of possession](https://whosonfirst.ai/flows/wimse-workload-tokens/index.md): A workload identity that is bound to a key and proven on every request, so it survives the gateways and proxies that agent traffic passes through.
- [Agent to agent (A2A)](https://whosonfirst.ai/flows/agent-to-agent/index.md): One agent discovers another, reads what credentials it wants, and presents them. When the remote agent needs more, it says so mid-task.
- [Web Bot Auth](https://whosonfirst.ai/flows/web-bot-auth/index.md): An agent that browses the open web signs its requests, so a site can tell which operator it belongs to without trusting a user-agent string.
- [Agent payments with signed mandates](https://whosonfirst.ai/flows/agent-payments/index.md): The user signs what the agent may buy. The agent proves, to the merchant and to the payment network, that a purchase falls inside it.
- [Credential injection at the egress proxy](https://whosonfirst.ai/flows/credential-broker/index.md): The agent never holds the secret. A proxy outside the sandbox adds it to outgoing requests, and only for the hosts it was meant for.

## Deployments

- [Agent deployments: where identity comes from](https://whosonfirst.ai/deployments/index.md): Where an agent runs decides where its identity comes from. Kubernetes, managed agent platforms, local machines, CI and sandboxes compared.
- [Hosted apps and backends](https://whosonfirst.ai/deployments/web-apps/index.md): An agent that runs on your own servers and works for whoever is signed in. It can keep a secret, and it holds every user’s tokens in one place. How to sign users in, where their tokens live, and what changes when the work outlives the request.
- [Agents on Kubernetes](https://whosonfirst.ai/deployments/kubernetes/index.md): How an AI agent running as a pod gets an identity, reaches cloud and external services without stored secrets, authenticates to other workloads, and carries a user’s delegation.
- [Managed agent platforms](https://whosonfirst.ai/deployments/agent-platforms/index.md): What cloud providers, identity vendors and model platforms offer for agent identity and authorization, and the questions to ask of any of them.
- [Desktop, IDE, CLI and CI agents](https://whosonfirst.ai/deployments/local/index.md): Agents on a user’s machine are public OAuth clients. Agents in a pipeline have a platform identity. How each should authenticate, where tokens live, and what to do about stdio MCP servers.
- [Sandboxed agents](https://whosonfirst.ai/deployments/sandboxes/index.md): Agents that execute untrusted code or read untrusted content should not hold credentials. How credential-injecting egress proxies work, and what they do not solve.
- [MCP and LLM gateways](https://whosonfirst.ai/deployments/gateways/index.md): A gateway in front of MCP servers and a gateway in front of model providers do different jobs. What each one checks, which credential it uses on the far side, and what the server or provider behind it can still tell about the caller.

## Reference

- [Glossary of agent authentication and authorization](https://whosonfirst.ai/glossary/index.md): Plain definitions for the vocabulary of agent authentication and authorization, from access token to workload proof token.
- [Standards for agent authentication and authorization](https://whosonfirst.ai/standards/index.md): Every RFC, draft, specification and project that matters for agent authentication and authorization, with current status and why it matters.

## Optional

- [About this site](https://whosonfirst.ai/about/index.md): What Who’s on First covers, how its facts were checked, how status is worded, and how to correct it.