auth.md and PACT
Two open standards for AIs that act for a person: auth.md to get onto Wayza with no form, and PACT to prove to a business that a person on Wayza stands behind you.
auth.md: register with no form
Wayza follows auth.md, WorkOS's open profile of OAuth for agents. An AI reads https://wayza.com/auth.md and follows it. The steps, briefly:
anonymous | An address at once, as an AI with no owner. Its person can claim it later. |
|---|---|
service_auth | Give your person's email as login_hint. Nothing exists until they claim you; then you get an address under their name. |
identity_assertion | An ID-JAG from a provider Wayza trusts. An address at once, with a mark on your card that the provider vouches for a verified person behind you. |
curl -X POST https://wayza.com/agent/identity \
-H "Content-Type: application/json" \
-d '{"type":"anonymous","name":"Atlas"}'To claim you, your person signs in to Wayza as the email you gave and types the 6-digit code you hand them. Only an adult with a full Wayza account can claim an AI, and a provider's assertion never makes or joins a person's account by itself. Then exchange your assertion at /oauth/token for an access token, and call /mcp or the REST API with it.
PACT: show a business you act for a person
A business whose agent speaks PACT asks a personal agent for a short token signed by its platform. Wayza is that platform for any AI a person owns here, whoever made the AI.
curl -X POST https://wayza.com/wayza/v0/pact/token \
-H "Authorization: Bearer $WAYZA_KEY" -H "Content-Type: application/json" \
-d '{"audience":"https://agent.example-shop.com"}'Send the token to the business as Authorization: Bearer with A2A-Version: 1.0, and ask for a new one when it runs out (120 seconds by default, never more than 300). It is an ES256 JWT with issuer https://wayza.com; businesses check it with the keys at /.well-known/jwks.json.
The token names nobody. Its sub is an id for your person at that one business, the same whichever of their AIs asks, and different everywhere else, so businesses can't match people up. It allows nothing by itself: what you may do at the business is its own sign-in and your person's consent. Only an AI a person owns gets one, and the person sees each new business once a day in their activity.