# Who is acting, for whom, and who said they could? Every API your agent calls needs those three answers, whether it is a calendar, a repository or a customer’s account. An API key gives it one. This guide starts from that key and goes as deep as the specifications. - New to this? [Start with the lessons](https://whosonfirst.ai/learn/) 6 short lessons, about 40 minutes. No OAuth knowledge needed. - Designing an agent? [Choose an authorization flow](https://whosonfirst.ai/guide/) Six questions, starting with whose authority the agent uses. - Know what you are looking for? [Browse flows and standards](https://whosonfirst.ai/flows/) 20 flows, step by step, and a [tracker of 96 specifications](https://whosonfirst.ai/standards/). What can the API tell? The agent attaches: **Its own API key** _Alice, then “What’s on tomorrow?”, to Agent, then API key, and a name, to Calendar API_ | What the API can tell | | | | - | - | - | | Who is acting? | Yes | The key belongs to the agent’s account. | | For whom? | No | `alice` is whatever the agent typed. The API cannot confirm it. | | Who said they could? | No | An administrator gave the agent its access. Alice approved nothing. | The API knows the agent is calling, and has to take its word for everything else. If Bob asks for Alice’s calendar and the agent sends Alice’s name, the API sees a valid key and answers. **Alice is protected only while the agent tells the truth about who is asking. Do not rely on a key to keep users apart.** The agent attaches: **A key Alice made** _Alice, then gives it a key from her account, to Agent, then Alice’s key, to Calendar API_ | What the API can tell | | | | - | - | - | | Who is acting? | No | The key is Alice’s. Nothing shows which software is using it, or that software is involved at all. | | For whom? | Yes | Alice’s account, because the key is hers. | | Who said they could? | Partly | Alice made the key, so she agreed to something. Most keys open the whole account and never expire. | The API can now tell Alice’s requests from Bob’s. But as far as it can tell, the agent _is_ Alice: whatever it does is recorded as her doing it, and the key usually allows everything her account can do, for as long as it exists. **It names the person and hides the software.** The agent attaches: **A token Alice approved** _Alice, then approves “read my calendar”, to Agent, then access token, to Calendar API_ | What the API can tell | | | | - | - | - | | Who is acting? | Yes | The token names the app it was issued to. Like a key, it works for whoever holds a copy. | | For whom? | Yes | The token names Alice, and the service that signed it vouches for that. | | Who said they could? | Yes | Alice did, for reading her calendar and nothing else. | The API can now tell Alice’s requests from Bob’s, refuse anything beyond reading a calendar, and block this one agent without locking Alice out. **What the agent can do for Alice is now limited by what Alice approved, and the API is the one enforcing it.** [A token Alice approved answers all three. Lesson 1 shows why](https://whosonfirst.ai/learn/what-the-api-sees/) An independent guide, not a specification · Reviewed November 2026 ## Learn it in order Each lesson answers one question and builds on the one before. [How the lessons work →](https://whosonfirst.ai/learn/) 1. [**What does the API actually see?** 5 min](https://whosonfirst.ai/learn/what-the-api-sees/) 2. [**What is a token?** 7 min](https://whosonfirst.ai/learn/tokens/) 3. [**How does an agent get a token for a user?** 8 min](https://whosonfirst.ai/learn/getting-a-token/) 4. [**What if nobody is there to sign in?** 7 min](https://whosonfirst.ai/learn/whose-authority/) 5. [**What happens when the agent calls a tool that calls an API?** 6 min](https://whosonfirst.ai/learn/chains/) 6. [**What limits the damage when something goes wrong?** 7 min](https://whosonfirst.ai/learn/limits/) ## Or start from what you are building Each goes to the page that says what to build, and what to leave to a library or a product. - [An assistant that works in each user’s own accounts · Hosted apps and backends](https://whosonfirst.ai/deployments/web-apps/) - [A job that runs on a schedule, with nobody signed in · Lesson 4: the agent’s own identity](https://whosonfirst.ai/learn/whose-authority/) - [A remote MCP server · MCP authorization: if you are writing the server](https://whosonfirst.ai/flows/mcp-authorization/#server) - [An agent on Kubernetes · Agents on Kubernetes: the short answer](https://whosonfirst.ai/deployments/kubernetes/#the-short-answer) - [A tool that has to call another API for the user · Lesson 5: chains of calls](https://whosonfirst.ai/learn/chains/) - [An agent that runs code it was given · Sandboxes](https://whosonfirst.ai/deployments/sandboxes/) ## Whose authority is the agent using? If you know the ground, start here. It is the first question to settle, and it decides whose name is on the token. **Whose authority is the agent using?** - **Acting for a person** The token names that person. Their permissions set the limit. - **Acting under its own service identity** The token names the agent. Policy an administrator sets is the only control. ### Then: Is a person available when access is needed? #### Yes, in the session - [MCP authorization](https://whosonfirst.ai/flows/mcp-authorization/) calling an MCP server - [Authorization code + PKCE](https://whosonfirst.ai/flows/authorization-code-pkce/) calling an HTTP API, with a browser at hand - [Device authorization](https://whosonfirst.ai/flows/device-authorization/) no browser where the agent runs - [Enterprise-managed (ID-JAG)](https://whosonfirst.ai/flows/cross-app-access/) the company identity provider decides - [Step-up authorization](https://whosonfirst.ai/flows/step-up-authorization/) a fresh approval for one sensitive action - [URL elicitation](https://whosonfirst.ai/flows/url-elicitation/) an MCP server needs a grant from a third party #### Reachable, but elsewhere - [Backchannel approval (CIBA)](https://whosonfirst.ai/flows/ciba/) ask them on a device they already use #### No The agent runs unattended on authority the person delegated earlier. The arrangement to be most careful with. - [Authorization code + PKCE](https://whosonfirst.ai/flows/authorization-code-pkce/) consent once, then run on a refresh token ### Then: Where does its identity come from? #### The platform it runs on - [Workload identity federation](https://whosonfirst.ai/flows/workload-identity-federation/) Kubernetes or a cloud workload calling an outside API - [SPIFFE + mTLS](https://whosonfirst.ai/flows/spiffe-workload-identity/) service to service inside your own platform #### A registered client credential - [Client credentials](https://whosonfirst.ai/flows/client-credentials/) a client with a key or secret of its own The decision guide asks four more questions: what the agent calls, who runs that, where the agent runs and what is at stake. Chains of agents and tools have [flows of their own](https://whosonfirst.ai/flows/#g-delegation). [Answer all six questions](https://whosonfirst.ai/guide/) [See all 20 flows](https://whosonfirst.ai/flows/) ## What is here ### [20 flows](https://whosonfirst.ai/flows/) Every flow as a sequence diagram you can step through, with the HTTP on the wire and who holds what at each step. ### [Deployments](https://whosonfirst.ai/deployments/) Hosted apps, Kubernetes, managed agent platforms, desktops and CLIs, CI pipelines and sandboxes: where identity comes from in each, and what a gateway in front changes. ### [Standards tracker](https://whosonfirst.ai/standards/) 96 RFCs, drafts and specifications with current status. 28 of them are still drafts. ### [Concepts on one page](https://whosonfirst.ai/concepts/) The lessons, compressed, with every caveat left in: the roles, what an API can verify, delegation and an annotated tour of nine tokens. ## Moving this year For readers who follow the specifications. As of November 2026. [Full tracker →](https://whosonfirst.ai/standards/) - [**MCP 2026-07-28** The protocol went stateless, deprecated Dynamic Client Registration, and made issuer validation mandatory for clients.](https://whosonfirst.ai/flows/mcp-authorization/) - [**Agents are workloads** The IETF WIMSE working group adopted an architecture for agent identity that composes existing standards and defines no new protocol.](https://whosonfirst.ai/standards/#wimse-aims) - [**Pod Certificates are GA** Kubernetes 1.37 gives every pod a native, auto-rotated X.509 identity. You bring the signer.](https://whosonfirst.ai/deployments/kubernetes/) - [**Approval can wait** The OAuth working group adopted Deferred Token Response: any grant may answer “not yet” while a human decides.](https://whosonfirst.ai/standards/#deferred-token-response) ## Every flow ### Human present - [Authorization code + PKCE](https://whosonfirst.ai/flows/authorization-code-pkce/) - [Device authorization](https://whosonfirst.ai/flows/device-authorization/) - [MCP authorization](https://whosonfirst.ai/flows/mcp-authorization/) ### Human in the loop - [Step-up authorization](https://whosonfirst.ai/flows/step-up-authorization/) - [Backchannel approval (CIBA)](https://whosonfirst.ai/flows/ciba/) - [URL elicitation](https://whosonfirst.ai/flows/url-elicitation/) - [AAuth](https://whosonfirst.ai/flows/aauth/) ### Delegation chains - [Token exchange](https://whosonfirst.ai/flows/token-exchange/) - [Enterprise-managed (ID-JAG)](https://whosonfirst.ai/flows/cross-app-access/) - [Identity chaining](https://whosonfirst.ai/flows/identity-chaining/) - [Transaction tokens](https://whosonfirst.ai/flows/transaction-tokens/) ### No human - [Client credentials](https://whosonfirst.ai/flows/client-credentials/) - [Workload identity federation](https://whosonfirst.ai/flows/workload-identity-federation/) - [SPIFFE + mTLS](https://whosonfirst.ai/flows/spiffe-workload-identity/) - [Workload tokens (WIMSE)](https://whosonfirst.ai/flows/wimse-workload-tokens/) ### Agent to agent, agent to web - [Agent to agent (A2A)](https://whosonfirst.ai/flows/agent-to-agent/) - [Web Bot Auth](https://whosonfirst.ai/flows/web-bot-auth/) - [Agent payments (AP2)](https://whosonfirst.ai/flows/agent-payments/) ### Cross-cutting - [DPoP](https://whosonfirst.ai/flows/dpop/) - [Credential broker](https://whosonfirst.ai/flows/credential-broker/) --- From Who’s on First, a field guide to agent authentication and authorization. This page: https://whosonfirst.ai/ Standards status last reviewed November 2026. Drafts move quickly: check the linked source before you build on one.