auth.md vs llms.txt vs agents.md
Three files, three jobs. Pick the right one — or use all three.
Published July 27, 2026
Quick answer:
- auth.md → "How do I get credentials for your API?"
- llms.txt → "What does your site do? Summarize it for me."
- agents.md → "I'm coding in your repo. What are the rules?"
Side-by-Side Comparison
| Aspect | auth.md | llms.txt | agents.md |
|---|---|---|---|
| Purpose | Agent authentication & registration | Content discovery & summarization | Codebase behavior rules |
| Location | /auth.md | /llms.txt | /agents.md or /AGENTS.md |
| Author | WorkOS | Jeremy Howard | Anthropic (popularized) |
| Question it answers | "How do I get an API key?" | "What is this site about?" | "What should I do/not do here?" |
| Use case | APIs, SaaS, services with auth | Docs, blogs, marketing sites | Code repositories |
| Format | Markdown + JSON endpoints | Plain text or Markdown | Markdown |
| Machine-readable? | Yes — structured protocol | Somewhat — for LLM context | No — human-readable rules |
| Shopify support | Not yet | Yes — points to /agents.md | Yes — canonical since May 2026 |
auth.md — Agent Registration Protocol
auth.md solves a specific problem: how does an AI agent sign up for your service without a human filling out forms? When an agent hits your API and gets a 401, it reads your auth.md to learn how to register.
The protocol includes discovery endpoints (RFC 9728), registration flows (identity assertion, service auth, anonymous), and token exchange. It builds on OAuth standards rather than replacing them.
Use auth.md when:
- You have an API that requires authentication
- You want AI agents to be able to sign up programmatically
- You need to issue scoped credentials to agents
Learn more: What is auth.md? · Full Specification
llms.txt — Content for Language Models
llms.txt tells AI models what your site is about. Think of it as a cleaned-up version of your content — no navigation, no headers, no cookie banners. Just the substance, formatted so a model can read it efficiently.
This is useful for documentation sites, blogs, and any content you want AI assistants to cite accurately. Instead of scraping your HTML and wasting tokens on boilerplate, they read your /llms.txt.
Use llms.txt when:
- You want AI assistants to accurately describe your product
- You have documentation that agents should be able to reference
- You care about AI citations and discoverability
Learn more: llmstxt.org
agents.md — Codebase Behavior Rules
agents.md (or AGENTS.md) is the operating manual for AI coding assistants working in your repository. It tells Claude Code, Cursor, Copilot, and other tools what to do and what to avoid — build commands, style guidelines, forbidden patterns, testing requirements.
This file lives in your repo, not on your domain. It's for agents that are writing code, not consuming APIs or reading content. Shopify made /agents.md canonical for all storefronts in May 2026, with /llms.txt now pointing to it by default.
Use agents.md when:
- AI coding assistants work in your codebase
- You need to enforce style guides, forbidden patterns, or testing rules
- You want to reduce hallucinations about your project structure
Learn more: What is AGENTS.md?
Can I use all three?
Yes — and many projects should. They serve different purposes:
- A SaaS with an API and docs might have all three: auth.md for agent registration, llms.txt for documentation, and AGENTS.md in the codebase for contributors.
- A documentation site probably just needs llms.txt.
- An open-source library probably just needs AGENTS.md in the repo.
- An API-first product definitely needs auth.md, and optionally llms.txt if it has public docs.
The Emerging Stack
The AI agent ecosystem is converging on a small set of well-known files:
| File | Layer | Analogous to |
|---|---|---|
robots.txt | Crawl permissions | "Can you access this?" |
llms.txt | Content understanding | "What is this?" |
agents.md | Behavior instructions | "How should I behave here?" |
auth.md | Authentication | "How do I get credentials?" |
x402 | Payments | "How do I pay?" |
Together, these files form a complete layer for agent autonomy: discover, understand, authenticate, and transact — all without human intervention.