{"id":"ia.agent-auth-readiness","name":"Agent auth readiness","verify":{"command":"curl -sf https://{domain}/auth.md","rescan":"isagentready results {domain} --checkpoint ia.agent-auth-readiness","expect":"The documentation explains self-serve API-key creation and named scopes, or an OAuth flow with discoverable metadata, PKCE S256 and scopes. This check does not attempt authentication."},"fix":{"steps":[{"action":"For API keys, explain where to create a key without manual approval and name the available scopes. For OAuth, publish the authorization server and protected resource metadata.","order":1,"language":null,"code_example":null},{"action":"Explain what each scope permits. For OAuth, list scopes_supported and include S256 in code_challenge_methods_supported.","order":2,"language":null,"code_example":null},{"action":"Publish /auth.md with the credential setup, narrowest usable scope and an authenticated request example for the supported flow.","order":3,"language":"markdown","code_example":"# Authentication for agents\n\nCreate an API key in the [dashboard](https://example.com/settings/api-keys) without manual approval.\n\n## Scopes\n- `catalog:read`: Read the catalog. Select this scope for catalog queries.\n\nSend the key in the Authorization header as a bearer token.\n\nExample: `curl -H \"Authorization: Bearer $API_KEY\" https://example.com/api/catalog`"}],"summary":"Document a scoped API-key flow or an OAuth flow with discovery metadata and PKCE S256.","skill":{"name":"security-trust","anchor":"ia.agent-auth-readiness"}},"category":"security","aggregate":null,"references":[{"title":"RFC 8414: OAuth 2.0 Authorization Server Metadata","kind":"spec","url":"https://datatracker.ietf.org/doc/html/rfc8414"},{"title":"RFC 9728: OAuth 2.0 Protected Resource Metadata","kind":"spec","url":"https://datatracker.ietf.org/doc/html/rfc9728"},{"title":"RFC 7636: PKCE","kind":"spec","url":"https://datatracker.ietf.org/doc/html/rfc7636"}],"expected":"A documented self-serve API-key flow with named scopes, or discoverable OAuth metadata with PKCE S256, scopes and an authentication walkthrough.","stage":"act","lifecycle":{"introduced":"2026-08-24","revised":["2026-10-30"],"retired":null,"replaced_by":null},"methodology_version":"2026-10-30","evidence_tier":"standard","evidence_source":{"title":"agentready.org AR-ACT-01","url":"https://www.agentready.org/#act"},"why":"Agents need a documented way to obtain credentials with permissions suited to the task. Self-serve scoped API keys or delegated OAuth with discovery metadata and PKCE can provide that path. Documentation does not verify that authentication succeeds.","profiles":["api_tool_readiness","agentic_commerce"],"score_role":"core","ar_strengths":{"AR-ACT-01":"SHOULD"},"ar_practice_ids":["AR-ACT-01"],"legacy_id":"5.14","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.agent-auth-readiness","strength_source":"agentready","i18n":{"nl":{"name":"Auth-gereedheid voor agents","steps":["Leg bij API-sleutels uit waar je zonder handmatige goedkeuring een sleutel aanmaakt en benoem de beschikbare scopes. Publiceer bij OAuth de metadata van de autorisatieserver en de beschermde resource.","Leg uit wat elke scope toestaat. Vermeld bij OAuth scopes_supported en voeg S256 toe aan code_challenge_methods_supported.","Publiceer /auth.md met het instellen van inloggegevens, de minimaal benodigde scope en een voorbeeld van een geauthenticeerd verzoek voor de ondersteunde flow."],"why":"Agents hebben een gedocumenteerde manier nodig om inloggegevens te verkrijgen met machtigingen die passen bij de taak. Dat kan met zelf aan te maken API-sleutels met scopes, of met gedelegeerde OAuth met vindbare metadata en PKCE. Documentatie bewijst niet dat authenticatie slaagt.","verify_expect":"De documentatie beschrijft het zelf aanmaken van API-sleutels met benoemde scopes, of een OAuth-flow met vindbare metadata, PKCE S256 en scopes. Deze controle probeert geen authenticatie.","fix_summary":"Documenteer een API-sleutelflow met scopes of een OAuth-flow met vindbare metadata en PKCE S256."}},"maturity":"recommended","applicability":{"mode":"detected_surface","condition":null,"surfaces":["auth"]},"strength":"SHOULD","ar_mapping":"full","evidence_type":"scanner_data"}