​
v0.1 — Initial Release

Released: April 2026
This is the initial release of the ATH protocol specification.

​
Protocol

  • Agent identity model with URI-based Agent_ID and signed JWT attestation (ES256)
  • Three discovery modes: manual configuration, gateway catalog (/.well-known/ath.json), service-side (/.well-known/ath-app.json)
  • Two-phase trusted handshake flow:
    • Phase A: App-side authorization (agent registration with capability approval)
    • Phase B: User-side authorization (OAuth 2.0 consent flow)
  • Scope intersection enforcement: Effective = Agent Approved ∩ User Consented ∩ Requested

​
API Endpoints

  • POST /ath/agents/register — Agent registration
  • POST /ath/authorize — Authorization request (with PKCE)
  • POST /ath/token — Token exchange
  • ANY /ath/proxy/{provider_id}/{path} — API proxy (Gateway Mode)
  • POST /ath/revoke — Token revocation

​
Security

  • Mandatory PKCE (RFC 7636) with S256 challenge method
  • Optional Resource Indicators (RFC 8707)
  • Token binding to (agent_id, user_id, provider_id, scopes) tuple
  • Form-encoded token requests per RFC 6749 §4.1.3
  • HTTPS (TLS 1.2+) required for all communications

​
Deployment

  • Two deployment models: Gateway Mode (zero service changes) and Native Mode
  • Three adoption levels: Gateway → Agent-Aware OAuth → Native ATH