AgentID Is Now Available for Descope
Descope-powered apps can now accept Sign in with AgentID. One discovery URL, a client ID and a few settings give every agent its own verified identity, and registered apps learn which human owns it. The setup guide is live in the docs.
- AgentID
- descope
- integrations
TL;DR
Descope-powered apps can now accept Sign in with AgentID. The setup guide is live: one discovery URL, a client ID and a few settings, with your own sign-in button. Agents arrive with a stable identifier and a verified email address, and apps that register learn the name and email of the human who owns each agent. Free for apps, and the fastest route is handing the integration prompt to your coding agent.
Descope is the latest platform where AgentID, the sign-in for AI agents from AgentMail, works as a custom OAuth provider. The Descope guide went live this week and walks the whole setup: the discovery URL, every connection field, the client types, the defaults to change, and the verification steps for your first real sign-in.
If your app runs its sign-in through Descope, this means an AI agent can now create its own account in it, with its own verified email address, instead of borrowing its owner's credentials. And because AgentID is plain OpenID Connect, the same tech as Sign in with Google, adding it is configuration, not code.
What does your Descope app learn about each agent?
Every sign-in delivers a stable sub, the agent's account key, which stays the same across every app the agent signs in to. The email claim is the agent's own inbox, verified at mint time, and it is a real working mailbox: onboarding, receipts, invoices and support replies all reach the agent directly, and it can read and answer them.
Apps that register an application can also request the owner scopes and receive owner_name and owner_email, the human behind the agent, in the id_token and from /v0/userinfo. That is what makes agent traffic governable: you can rate-limit, allowlist and ban per owner rather than per account, and cap signups per owner in the console. The full claim reference is in the docs.
AgentID is free for apps, with no per-sign-in fees.
How do you add it?
The shortest path is the integration prompt on agentid.com: paste it into your coding agent, and it reads the machine-readable reference and runs the CLI for you. By hand, the same two steps are:
Bash
npx @agentmail/agentid-cli init
The CLI collects your application name and callback URLs, registers the application and stores its credentials. It cannot edit connectors it does not recognize, so you finish the Descope side yourself: create a custom OAuth provider with discovery pointed at https://auth.agentid.com/.well-known/openid-configuration, the openid email profile scopes, and PKCE on with S256. The Descope guide lists every field value, including what goes in Client ID and Client secret for each client type.
No registration is needed to start: an open client uses an https URL you control as its client_id, with no secret and no setup. Register when you want the owner scopes.
For the button itself, the label is Continue with AgentID, one word, never shortened and never AgentMail. Adding a Sign in with AgentID button covers the design side, and the official marks are on the brand page. Flows that start the sign-in without a visible button use an initiate login URI; the guide covers its requirements too.
Which defaults should you change before the first test?
Four settings in a typical custom OAuth connector do not match what AgentID issues, and the guide walks each one:
| Setting | AgentID | The usual default |
|---|---|---|
| id_token signing | ES256 only | RS256, which rejects valid tokens with a signature error |
| Response type | code only | Implicit and hybrid flows are rejected |
| PKCE | S256 only | Plain or missing challenge fails |
| Refresh tokens | None; tokens last 10 minutes | Requesting offline_access gets you nothing |
One timing detail is worth knowing before it bites: an agent sign-in has no password form. The browser lands on an AgentID waiting page, the sign-in can take up to five minutes, and the authorization code then lasts sixty seconds. Keep state and the PKCE verifier for at least ten minutes, or the callback fails with a mismatch that looks like an attack. After the first approval, agents pass straight through for 180 days. The guide covers the whole wait, and how an agent proves its identity explains what happens on that page.
Where does this fit?
One name to keep straight: this is about accepting AgentID sign-ins in a Descope-powered app. Descope also builds its own agent identity product, and AgentID vs Descope Agentic Identity covers how the two differ.
Descope joins Clerk, Supabase, Auth0, Better Auth and Auth.js in the provider guides, and any OIDC stack works directly against the endpoints. Apps already accepting agent sign-ins are in the directory. If you ship it, tell us; we link to apps that let agents in.
