The latest articles on DEV Community by No Form (@noform). https://dev.to/noform https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3970862%2F0777b5db-076a-4fbe-b725-e8f260a04b8a.png https://dev.to/noform en No Form Sat, 06 Jun 2026 07:45:28 +0000 https://dev.to/noform/building-a-consent-preserving-authmd-skill-for-openclaw-agents-1765 https://dev.to/noform/building-a-consent-preserving-authmd-skill-for-openclaw-agents-1765 <p>Signup forms were designed for humans with browsers. AI agents get a 401 and have nowhere to go.</p> <p><a href="https://workos.com/auth-md" rel="noopener noreferrer">auth.md</a> (WorkOS, MIT) changes that: a tiny Markdown file at your domain tells any agent how to register — what flows you support, what endpoints to hit, what scopes it’ll get.</p> <p>I just shipped an OpenClaw skill that implements the <strong>user-claimed</strong> flow end-to-end:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>openclaw skills <span class="nb">install </span>auth-md-signup </code></pre> </div> <h2> The flow in 90 seconds </h2> <ol> <li>Agent sees <code>401 WWW-Authenticate: Bearer resource_metadata="…"</code> </li> <li>Two-hop discovery: PRM → AS metadata → <code>agent_auth</code> block</li> <li>POST anonymous registration → gets <code>claim_token</code> </li> <li>Asks <strong>you</strong> for your email in-channel</li> <li>Service emails OTP → you paste it back</li> <li>POST <code>claim/complete</code> → scoped, revocable credential stored</li> </ol> <h2> Why the OTP step is non-negotiable </h2> <p>The agent can’t complete signup without you. No silent account creation, no credential exfiltration. The human OTP step is the consent gate — remove it and you remove the accountability that makes delegated signup trustworthy.</p> <p>The reference implementation uses <a href="https://noform.dev" rel="noopener noreferrer">NoForm</a> — which hosts auth.md infrastructure for services that don’t want to build it themselves. The skill works with any auth.md-compliant service.</p> <h2> Error handling built in </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Code</th> <th>What happens</th> </tr> </thead> <tbody> <tr> <td><code>otp_invalid</code></td> <td>Ask user to retry (max 3x)</td> </tr> <tr> <td><code>otp_expired</code></td> <td>Offer to re-send OTP</td> </tr> <tr> <td><code>claim_expired</code></td> <td>Restart anonymous registration</td> </tr> <tr> <td><code>previously_claimed</code></td> <td>Tell user, stop</td> </tr> <tr> <td><code>anonymous_not_enabled</code></td> <td>Tell user, stop</td> </tr> </tbody> </table></div> <h2> Revocation </h2> <p>One call to <code>revocation_uri</code> with the token. Agent deletes it locally. Your account stays intact.</p> <h2> Links </h2> <ul> <li>ClawHub: <a href="https://clawhub.ai/skills/auth-md-signup" rel="noopener noreferrer">clawhub.ai/skills/auth-md-signup</a> </li> <li>Protocol: <a href="https://github.com/workos/auth.md" rel="noopener noreferrer">github.com/workos/auth.md</a> </li> <li>Reference implementation: <a href="https://noform.dev" rel="noopener noreferrer">noform.dev</a> </li> </ul> openclaw