Pre-rewrite scenario. This walkthrough was written against an earlier draft of draft-hardt-aauth-bootstrap. As of -01 the document is informational AP-side enrollment guidance; the PS /bootstrap endpoint, bootstrap_token, and aa-bootstrap+jwthave been removed. PS-binding now happens lazily on the agent's first interaction with the PS. See the bootstrap overview for current framing.
Self-Hosted Bootstrap
Agent and agent provider co-located under a user-controlled domain. Self-issues agent tokens; PS binding is optional. No platform attestation required — the user controls the entire stack and can establish trust through other means (mTLS, domain ownership, etc.).
User deploys their own agent provider under a domain they control.
The agent and agent provider are co-located (same machine/container).
User configures the server with signing keys and metadata.
No platform attestation needed — the user controls the infrastructure.
Step 1: Deploy agent provider
No headers