How to Let AI Agents Sign Up for Your App Safely — Isabelle Williams, WorkOS

AI Engineer · 18 min · 229 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

1. 00:01[music]
2. 00:12Hi everyone.
3. 00:13My name is Isabel.
4. 00:14I'm a product manager at WorkOS.
5. 00:17Today, I'm going to be talking about how your next user is an agent.
6. 00:21Briefly on WorkOS, we do infra for auth.
7. 00:24We help you build apps, agents, APIs.
8. 00:27We're trusted by over 3,000 customers including OpenAI and Propel and Cursor.
9. 00:33Okay.
10. 00:34For my presentation today, I'm going to be using an app that I live coded with Cursor.
11. 00:39It's called Waypoint.
12. 00:40It is a travel planning app both for individual use and for company travel.
13. 00:45And we're going to use Waypoint today to help plan our trip to AIE in New York City.
14. 00:52All righty.
15. 00:52So, over the past year, but especially in the past few weeks with Muse and Instinct and the rise of personal agents, I've been thinking a lot about what this means for Waypoint.
16. 01:02The first thing that I've been thinking about is how do I let agents into my app?
17. 01:07So, when I think about the personal travel tier of Waypoint, before agents, it's, you know, really important from like a product led growth perspective to think about how human users discover my application,
18. 01:19get signed up, and get to that aha moment really quickly.
19. 01:22But when I think about how I'm using personal agents, and how I think others are going to be using personal agents if they're not already, is that they're going to be turning over a lot of that research, product discovery, and getting started with the product, and getting to that aha moment
20. 01:35totally over to their agents.
21. 01:36So, I'm thinking about how it's going to be really important that I let agents do this with Waypoint.
22. 01:42Now, as I got a little further into that thinking, the next question that I have is how do I connect those agents that are getting started with my product in this mode
23. 01:50to real customers?
24. 01:53And then finally, as I think more about how Waypoint works for company travel for corporate teams.
25. 01:59There are compliance and financial risk elements to that.
26. 02:02So, it's really important to me to make sure that I can limit what an agent can do.
27. 02:06Um I can revoke it when I need to.
28. 02:09So, with those three questions in mind, let's talk through how I did them with Waypoint.
29. 02:14So, the first thing that I'm thinking about, how to let agents in.
30. 02:18Um if you go to this link here, um it ends in off.md.
31. 02:23So, this is a real link.
32. 02:24You can actually go to this, but it's not meant for us.
33. 02:26It's meant for agents.
34. 02:28Off.md is an open protocol um that um talks about how agents can register for accounts with applications.
35. 02:38Off.md is a markdown file that you host with your application.
36. 02:43And again, you can go to it and read it, but it's not meant for us.
37. 02:46It's meant for your agent.
38. 02:47It's where an agent can discover how to get started with your application.
39. 02:52It describes the mechanisms for getting access, for creating an account, um and being able to call an user API.
40. 03:00One thing that's important to remember with Off.md is that it describes access and operations, but your application, so in this case Waypoint, is the one that's enforcing off theory API.
41. 03:11So, in this Off.md file that I'm going to talk about for Waypoint and I'm going to demo, um there's two modes to it.
42. 03:18The first mode is allowing agents to um try my application in anonymous mode.
43. 03:24So, I want agents to be able to take limited to prove that my application has value without having to sign up and create an account.
44. 03:32But to the second question I posed earlier, I really want these agents to be acting on behalf of users.
45. 03:37So, I want to be able to expand the available actions um that I give to these agents when I can tie them back to a real user.
46. 03:45So, let's jump into the first mechanism of the Off.md Off.md protocol for how that can happen.
47. 03:52So, this flow goes from letting an agent try things out in an anonymous mode, and then a user coming in and claiming what that agent did and transferring the actions over to the agent account.
48. 04:04So, the first part of this protocol is an agent being able to take anonymous actions at my API.
49. 04:11So, in the end of this, the agent gets an access token, and then they get something that a claim token that eventually is going to let a user claim what the agent did and move it under that user's account.
50. 04:24So, the flow to this one, at some point when the user wants to take ownership of what their agent is doing, the agent can give them a link and
51. 04:31a one-time code.
52. 04:33The user comes over to my application, Waypoint.
53. 04:36They sign up, they sign in, they enter the code.
54. 04:39They've claimed what the agent has done, they've brought it under their account.
55. 04:43And finally, using OAuth, my authorization server can issue an access token on behalf of that user to the agent, and the agent's going to use that to call my API.
56. 04:54So, this lets the agent do things, but you might have noticed there is a link and a sign-up flow and entering a code and verifying my email.
57. 05:04And if you know anything about product-led growth, you know this is where you lose your user.
58. 05:09But, doesn't my agent already know who I am?
59. 05:14Like, when you guys use Cloud Code today, when you use Muse, you're signed in.
60. 05:19And that service has done something to verify that you are who you say they are to you say you are because they care about ensuring that you are probably a real person.
61. 05:29So, they verified your email or something to that extent.
62. 05:32So, if the agent knows who I am, why can't the agent provider just tell my application who I am and let me in without me having to take manual actions?
63. 05:46Well, that's also possible with AuthMode.
64. 05:49So, I'm going to break down this protocol and the standard called ID Jag that it's built on and I'll show you a little demo of how this works.
65. 05:56So, to break this down, this starts with your agent discovering how to authenticate with your API.
66. 06:01This is like standard OAuth parlance of finding out about your protected resource, your API, your MCP server, um and your OAuth authorization server.
67. 06:11And then things get a little fun.
68. 06:12So, your agent is going to come to you as the user and ask for consent to share your identity and your email with the application Waypoint.
69. 06:21If you consent, the agent goes to the agent provider.
70. 06:25So, your you know, Claude agent goes to Claude and says, "Hey, give me an ID Jag."
71. 06:31Put a pin in that.
72. 06:32I'll come back to what that is in a second.
73. 06:34So, the agent gets the ID Jag, sends the ID Jag over to your API's authorization server.
74. 06:41Your application, your authorization server is going to verify that that ID Jag is the real deal.
75. 06:47It's going to see some information on you inside of it and then your app is in control of deciding, am I going to create an account for this user?
76. 06:54Am I going to link it to an existing account?
77. 06:56What sort of access am I going to give back in the access token to this agent?
78. 07:00Your app is completely in control of that.
79. 07:03And so finally, with that access token, the agent can call your API on behalf of the user.
80. 07:11So, I said something, to use a Claude term, a little bit load-bearing um in this ID Jag.
81. 07:16Has anyone here heard of ID Jag?
82. 07:20I see one person and he works with me, so that's funny.
83. 07:23Um so, if you've been following what Claude is doing, what Anthropic is doing with enterprise managed authorizations in the MCP spec, what Okta is doing with cross-app access, that's using the same spec, the same protocol called ID Jag.
84. 07:36Let me break down what that is.
85. 07:37So, ID Jag, Identity Assertion Joined Authorization Grant.
86. 07:41This is a spec in the IETF.
87. 07:44Um effectively what an ID jag is is an assertion of a user's identity.
88. 07:49It's signed by an issuer.
89. 07:51So, in this flow, the agent provider is the issuer.
90. 07:54And it's sent for a specific audience.
91. 07:57So, again in this flow, the specific audience is my application.
92. 08:01And let's break down what's in this.
93. 08:04Um in the header, it tells you that this is of type ID jag, the algorithm used for signing, and the signing key.
94. 08:13In the payload, this is where things get interesting.
95. 08:16It tells you who issued it, which in this case is the agent provider.
96. 08:19It gives you information from the agent provider on the user.
97. 08:23So, the user's name, their email, whether the email was verified.
98. 08:30And then it tells you who it's for.
99. 08:31So, the audience is my application Waypoint, and a client ID is a client that's known to Waypoint.
100. 08:37And then finally, it tells you how long it's valid.
101. 08:40And most importantly, it's signed by the issuer, the agent provider's public key.
102. 08:46So, Waypoint, their authorization server, gets this ID jag.
103. 08:50They are going to verify um the signature.
104. 08:54And it's up to Waypoint what they want to trust in this.
105. 08:56It's completely up to Waypoint if they want to create an account for this user, what sort of access they want to what sort of scopes they want to give in the access token that they hand back to the agent on behalf of this user.
106. 09:09So, let's see what that actually looks like in action.
107. 09:14To give you a demo.
108. 09:15Um so, I am in an agent harness that I built here.
109. 09:19This agent harness is able to issue ID jags.
110. 09:22I am logged in to this agent harness as Sam Rivera.
111. 09:25I have an email, and this is a fresh user.
112. 09:28It Waypoint doesn't know anything about this user.
113. 09:30It's never seen this user before.
114. 09:32And I am going to say to my agent Harness, um let's see here.
115. 09:40Plan I need to put down my mic.
116. 09:54Okay.
117. 09:55So, I'm telling my agent Harness, I want you to plan my itinerary for a New York City and I want to be able to share with my co-workers and I want you to find a tool that's going to do the planning and make it easy to share, all that good stuff.
118. 10:08So, my agent Harness is going and looking at tools.
119. 10:12It's finding some other travel itinerary planning tools like Maple itinerary, um and it can't get through to there cuz it needs a browser sign up, TripIt needs an API key,
120. 10:21but Waygo allows for agents to sign up.
121. 10:24And so it asked me for consent.
122. 10:26Can I share your name and verified email with Waygo?
123. 10:30I'm going to say yes.
124. 10:31And then Waygo and Waygo's off and be filed also asked for some other consent for some more elevated permissions.
125. 10:37In this example, it's allowing Waygo to book dinner reservations with the agent.
126. 10:43So, I give it my consent.
127. 10:46And my agent Harness is going to talk to Waygo about this.
128. 10:52Let's see what it does.
129. 10:56Okay, it's verified my identity.
130. 10:59It created my Waygo account.
131. 11:00I didn't have to do anything.
132. 11:01Totally hands-off on my part.
133. 11:08Oh, it booked a trip, dinner reservation, and my itinerary is ready to share.
134. 11:14Okay, look at that.
135. 11:16Um there's my itinerary.
136. 11:17It booked me dinner at Quality Bistro, which is quite good.
137. 11:19If anyone has been there before, I would I would recommend it.
138. 11:22Um it's given me a link that I can share with my colleagues.
139. 11:25And all that was done without any interaction on my part.
140. 11:29So, that was pretty cool.
141. 11:31Um what I'll final thing I'll say on the ID Jack part is that um, what I feel really confident in in um, kind of this era of agents accessing other things
142. 11:42is that for us to be able to do this safely and securely and in a trusted manner, it's going to all need to be built on open standards.
143. 11:49Um, we are all going to need open standards for agents to talk to services to do things to pay to sign up for accounts.
144. 11:56Um, so I'm really excited about a lot of the standard standardization work that's been happening right now.
145. 12:00A lot of things are announced like just over the past week.
146. 12:04All right, moving on to the last part of this presentation.
147. 12:08How can I limit and revoke what an agent can do?
148. 12:12So, for me this is really important in Waypoint because I allow for corporate travel booking.
149. 12:19And I want to let corporate employees responsible for travel booking um, use agents.
150. 12:24I want to build agents for them.
151. 12:26But with this, there's real corporate money on the line.
152. 12:30I need to be able to audit.
153. 12:31I need to be able to make sure that money is not thrown around in ways that it shouldn't be.
154. 12:37So, introducing a persona here.
155. 12:38Jordan, Jordan's responsible for company funds at Jordan's company.
156. 12:42Um, Jordan's the only one that can approve budget and approve her rules.
157. 12:47Now, I've built a couple of agents into Waypoint for Jordan to use.
158. 12:51The first one's read only.
159. 12:52It's your classic chatbot that Jordan can ask, "Hey, what's wrong with the budget?"
160. 12:56or whatever.
161. 12:57Um, and it'll tell it, but it can't actually do anything.
162. 13:01But then I built Jordan a fund agent.
163. 13:03This fund agent is going to actually be able to move funds around between users.
164. 13:07Let's say that one user is flying from San Francisco and flights are really expensive compared to the user coming in via train from Boston.
165. 13:14And so Jordan wants to be able to move funds around, but as long as it's happening within the budget and the approved rules, Jordan doesn't need to manually do it himself.
166. 13:23He can use the agent.
167. 13:25But it's really important to Jordan that the funding agent can't go rogue.
168. 13:28It can't change the budget.
169. 13:30It can't change the approval rules to make things work.
170. 13:34So, how do I make this happen within my application?
171. 13:36So, Jordan invokes an agent.
172. 13:40And on the back end of my app, my app issues agent tokens.
173. 13:45So, it's really important to me that I don't just hand an agent Jordan's user token.
174. 13:49There's a few reasons for this.
175. 13:51One is auditing and attribution.
176. 13:54Two is revocation.
177. 13:56I want Jordan to be able to revoke the agent.
178. 13:59I want to be able I want my application to be able to revoke the agent without impacting Jordan's session and Jordan's access.
179. 14:05And then finally, I want to be able to limit what the agent can do.
180. 14:09I want to limit the scopes in the token.
181. 14:11So, the way that I've set these agents up is I've created a blueprint or like a ceiling of access for the read-only agent and for the fund agent.
182. 14:19And when Jordan invokes them, um the agent token that's issued for the agent, the scopes in it is the intersection of Jordan's user permissions and the scopes in the ceiling of the agent blueprint.
183. 14:32And so then finally, the agent can call my API with a scoped access uh sorry, a scoped agent token.
184. 14:38So, I'll just briefly show you what that is and then I'll end with some QR codes here so you guys can check out um all of this stuff.
185. 14:44So, I am in Waypoint as Jordan.
186. 14:46I am looking at my team travel here.
187. 14:49I have a team budget.
188. 14:50There's looks like $70 available.
189. 14:53Start up my read-only agent.
190. 14:58All right.
191. 14:59So, my read-only agent is started.
192. 15:01If I take a look here at the session details, what we were talking about earlier with Jordan's user token, it's here on the left.
193. 15:08I can see that Jordan has a bunch of permissions.
194. 15:10The agent blueprint for the read-only agent is in the middle.
195. 15:12It only has one permission.
196. 15:14Um it has some session session information.
197. 15:18And then the agent token, it's issued by my application.
198. 15:22The subject of the agent token is the agent ID, so it's attributable to the actual agent.
199. 15:30It's acting on behalf of Jordan the user, so I have that information in there as well.
200. 15:35And the permissions are the intersection between Jordan's user token and the agent blueprint.
201. 15:40Um so I'm in the interest of time, I'm going to skip the read-only agent and just move over to the fund agent cuz it's a little more interesting.
202. 15:48So starting up this fund agent, I'm going to ask it to fix Alex's budget.
203. 16:08Okay, so Alex has a $250 shortfall.
204. 16:13Um do you want me to rebalance funds?
205. 16:15Yes, rebalance.
206. 16:18Hard to do while holding a mic.
207. 16:26All righty, so the funding agent was able to move $70 over to Alex, but they can't fix all of it because there's no more budget available left.
208. 16:36And the funding agent doesn't have the ability to change the budget, but I as Jordan do.
209. 16:41So my user is still able with their user token to change the budget.
210. 16:46Let's change it to 2,000.
211. 16:53So as the user I was able to do that.
212. 16:55The agent couldn't.
213. 16:56Um and then so I'm going to tell it I increased the Oop.
214. 17:04budget.
215. 17:16Okay, there we go.
216. 17:17And so the agent was able to fix Alex's budget.
217. 17:20So really what we showed here is that how you can build agents into your application um putting a ceiling on their permissions and they operate using an agent token with that scoped access instead of taking your user's token or an API key.
218. 17:35So you can audit it.
219. 17:36It's um yeah, you can audit it, you can revoke it and you can make sure that you limit the permissions of that agent.
220. 17:43All righty.
221. 17:45Coming back in here, I just showed that demo.
222. 17:47Um so three takeaways here, um how you can let agents into your application with an Auth MD file, how you can connect them to a customer using the user claim flow in Auth MD
223. 17:57or the ID Jag identity assertion, and then finally how you can limit actions by enforcing permissions and revocation.
224. 18:05I'll end with some QR codes.
225. 18:07Um the one on the left for Auth MD, like I said, it's an open standard.
226. 18:10Um and the one on the right is WorkOS agent auth, which is how I was able to um build agents into my application with limited permissions using an agent token.
227. 18:20And I will end my talk there.
228. 18:22Thank you all so much.
229. 18:23And if anyone has any questions, I'm happy to talk about it after.