Protocol Explorer
An interactive walkthrough of the AAuth protocol. Pick a scenario, step through the requests, and see the real headers and tokens at each hop.
The four server roles
Every scenario involves some subset of these roles. Use the sidebar to drill into each area.
Makes signed requests, holds keys, proposes missions
Protected API; verifies person tokens, issues resource tokens, enforces auth tokens
Represents the person; issues person tokens, manages missions, federates to AS
Issues auth tokens; enforces resource access policy
Three layers
AAuth stacks identity proof, authorization against resources, and optional mission governance. Each layer links to comparison or entry pages; the sidebar lists every scenario.
Identity
How an agent cryptographically proves who it is on every request — from pseudonymous keys (no account) to agent tokens that bind a signing key to an identifier. Built on HTTP Message Signatures and the Signature-Key header.
Resource access
How a protected API decides what the agent may do. Five modes, sorted by what the resource ends up knowing: which agent, which person (its own flow, or a login the Person Server ran), person plus consented scope, or person plus an Access Server's policy verdict.
Mission
Optional governance: the agent proposes a mission; the Person Server approves it, returns the blob and its digest, and threads that digest through every token it later issues. Also covers delegation across resources and advanced interaction patterns.
Spec reference
How AAuth profiles RFC 9421 and the Signature-Key draft