The Easiest Way to Take Your App to AI Agents
On this page
Every developer building software today is watching the same shift: people aren't just clicking buttons in dashboards anymore. They are delegating workflows to AI agents running in Claude Code, Cursor, Windsurf, and custom execution loops.
Those agents want to interact with your app. They want to create a task, update a database record, read an issue, or trigger a deployment.
Up until now, making your app accessible to those agents meant choosing between bad tradeoffs:
- OAuth 2.0 with browser consent redirects: Works great for humans in a web browser. But when an autonomous agent hits a consent screen or 2FA prompt, it halts and asks the human to babysit it. Autonomy disappears.
- Long-lived API keys in prompts: Asking users to paste their production API keys into an agent prompt or
.envfile means credentials leak into shell histories, debug logs, and LLM context windows. - Building bespoke tool servers: Maintaining a separate tool server just to expose endpoints you already built as an HTTP API adds maintenance overhead and burns precious context tokens.
There is a much simpler way.
Your API is already ready. It just needs identity.#
Your service already has REST endpoints. It already has route handlers. It already knows how to parse JSON and update your database.
The only missing piece was verifiable delegated identity: a way for an agent to prove which human user it is acting for, without handing the agent that human's master credentials.
That is what AgentOnboard provides.
[ Human User ] ── authorizes laptop once ──▶ [ aon CLI ]
│
▼
[ Agent in Cursor / Claude Code ] ── calls ──▶ [ Your API ]
(Bearer <5-min domain-scoped JWT>) │
▼
Local RS256 Verification
(No callbacks, no proxy)
- The human user generates an identity key once and saves it on their machine.
- When their agent needs to talk to your app (
notes.com), the agent asks its local CLI for a token:aon token get notes.com. - The CLI mints a 5-minute RS256 token scoped exclusively to
notes.com. - The agent calls your API with
Authorization: Bearer <token>. - Your API verifies the token locally against our public JWKS, extracts the user's verified email, and maps it to your existing database.
3 lines of code in your backend#
You don't need a partner console, an application registration form, or client secrets. You just install @agentonboard/sdk and add the verifier to your route handler:
import { requireAgentAccount } from "@agentonboard/sdk/next";
export async function POST(request: Request) {
const session = await requireAgentAccount(request, {
audience: "notes.com",
resolveAccount: async ({ email }) => {
// Find the user in your database
return await db.user.findUnique({ where: { email } });
},
});
// Rejections (401 invalid/expired, 403 no account) are handled automatically
if (!session.ok) return session.response;
// session.user is your own database user
return Response.json({ success: true, created_by: session.user.id });
}
Building in Python with FastAPI? It takes the same few lines using standard pyjwt against our public keys (https://agentonboard.xyz/.well-known/jwks.json).
Zero roundtrips on your hot path#
Security shouldn't cost latency. AgentOnboard is not a proxy and does not sit between your users and your servers:
- Local verification: Verification runs inside your own process against public keys cached in memory. There is zero network roundtrip back to AgentOnboard on incoming requests.
- Strict domain binding: Tokens are cryptographically bound to your hostname (
aud). A token minted for another service cannot be replayed against yours. - 5-minute lifespan: Even if a token is intercepted in flight, it expires in 300 seconds.
Tell agents how to find you with auth.md#
To complete the loop, drop a static auth.md file in your public/ directory:
## Audience
notes.com
## Endpoints
### POST /api/notes
- Header: Authorization: Bearer <token>
- Body: { "title": "string", "content": "string" }
- Response: 200 { "success": true }
## When a request is rejected
- 401: Token expired or invalid signature. Mint a fresh token with `aon token get notes.com`.
- 403: No account found for this email. Connect your account at https://notes.com/connect.
When an agent encounters your service, it reads https://notes.com/auth.md, discovers the required audience and endpoints, mints a token, and makes the call.
Start taking your app to agents today#
Making your app accessible to the next wave of AI agents doesn't require rebuilding your auth stack or running complex protocols.
Keep your existing API, verify tokens locally, and let agents get to work.