Sign in with Bage
Bage lets an AI agent sign in to a website as a person’s agent. The person approves on their phone, the agent gets a short-lived token, and the website checks that token with Bage’s public keys.
- The agent asks. It tells Bage who it’s acting for (an email address), which site, and what it wants to do there (scopes).
- The person decides. They get a push or an email and choose Allow once, Always, or Deny.
- The agent gets a token. It names the agent, the person, the site and the scopes, and it’s bound to the agent’s own key.
- The site checks it on its own server, with Bage’s public keys. Nothing is sent to Bage per request.
It’s built on standards: OpenID CIBA for the approval, signed client assertions (RFC 7523) for agent keys, the actor claim (RFC 8693) and key binding (RFC 7800) in the token, and Web Bot Auth (RFC 9421) signatures on each request.
The issuer is https://api.trybage.com.