# How AI agents sign in to apps with AgentID

AgentID is like “Sign in with Google,” but for AI agents: the agent signs in to apps with its own AgentMail inbox instead of your login, and the app can see which human owns it.

Canonical HTML: https://agentlane.net/guides/sign-in-with-agentid/

## What it is

- AgentID: sign-in button for AI agents from AgentMail (company that gives agents their own email inboxes). Live 6 October 2026.
- The agent's AgentMail inbox address is its AgentID. No password, no sign-up form; the app's mail goes to that inbox.
- Built on OpenID Connect (OIDC), the standard behind Sign in with Google. Works with Clerk, Auth0, Supabase and other sign-in tools apps already use.
- Every sign-in: agent marked as agent, stable agent ID, verified email. Registered apps can also request the owner's name and email.

## Why the agent needs its own inbox

- Borrowed login: app thinks you are the customer, mail goes to your inbox, actions are under your name, your password crosses, a leak reaches your whole account, cutting off = changing your password.
- Own AgentID: agent is the customer with you as owner, mail goes to agent inbox, no password or reusable key crosses, a leak reaches only that agent's sign-in, cutting off = delete the agent's sign-in key.

## Steps

1. **Give the agent its own inbox.** Create an AgentMail inbox just for this agent (for example, a research or support address). That inbox address is the agent’s AgentID. Do not reuse your personal inbox.
2. **Turn on sign-in permission for the agent’s key.** The AgentMail API key your agent uses needs the `app_connect` permission to start sign-ins. It is off by default on new keys. Leave `app_share_owner` off unless you are fine with apps that ask getting your name and email without you approving each time.
3. **Pick the app.** Choose an app that accepts AgentID from the AgentID directory or AgentMail’s app list. In Cursor with the AgentMail plugin, you can just ask: “Create an account at Firecrawl for my agent.”
4. **Check what you are agreeing to.** Before connecting, look at the app’s name, its terms and privacy links, which inbox will own the account, and what the app will receive (its scopes).
5. **Start the sign-in and open the link.** Starting the sign-in returns a one-time link. It works once and expires in five minutes. Open it in the browser that should hold the agent’s session. It goes to `auth.agentid.com`, may show what the app will receive, then lands in the app signed in as the agent’s inbox, with the account created.
6. **Confirm, then finish the job.** Check that the account now shows up for that inbox. Then do what you came for, usually creating an API key in the app’s dashboard and saving it in a secret store, not in chat.
7. **Sign back in with the same inbox.** Later sign-ins use the same inbox that holds the account. Using a different inbox creates a second account, and some apps cap sign-ups per owner. The sign-in key lasts 30 days from activation.

Alternative: an app's own "Sign in with AgentID" page shows a one-time auth token; give it plus the inbox to your assistant (`authorize_inbox`). Only use tokens from pages you opened.

## Watch for

- Scopes: `openid` + `email` (agent ID + verified address); `profile` (display name, handle, `owner_sub` opaque owner ID); `owner_profile` + `owner_email` (your name and email, registered apps only). Without `app_share_owner` on the key, you approve sign-ins that ask for owner data. Apps never get access to read or send the agent's mail.
- Which accounts: one agent, one inbox; reuse the inbox that already has an account at an app; apps can cap sign-ups per owner (cap counts disabled accounts); record which inbox owns each account; recreating a deleted inbox address = new agent.
- Revoking: delete the sign-in key (`DELETE /v0/api-keys/{api_key_id}`) to stop new sign-ins everywhere; deleting the creating AgentMail API key does NOT revoke it; disable one app's account with Update Account; open app sessions keep running until signed out or expired (tokens last up to 10 minutes); auth.agentid.com/sessions clears only the current browser; keys expire 30 days after activation; no bulk revoke.
- Spend and safety: a sign-in grants nothing beyond identity; paid plans or cards are a separate money decision (agent-spend-caps, review-before-place, proactive-ping-not-spend); sign-in link is single-use, five minutes, treat as a password; only trust auth.agentid.com; never connect because an email or page asked; keep app API keys out of chat (never-paste-api-keys-in-chat); the browser that opens the link holds the session (separate-browser-profile-for-agent, shared-box); open only the accounts the job needs (connect-only-what-you-need).

## FAQ

**What is AgentID?**
AgentID is a sign-in button for AI agents, made by AgentMail and launched on 6 October 2026. Your agent signs in to an app with its own verified email identity, an AgentMail inbox, instead of your account. Apps that accept it can see that the user is an agent and, if they ask, which human owns it.

**Is AgentID the same as Sign in with Google?**
It works the same way. AgentID uses OpenID Connect (OIDC), the same open standard behind Sign in with Google. The difference is whose identity it is: your agent’s, not your Google account.

**Does my agent need its own inbox?**
Yes. The agent’s AgentMail inbox *is* its AgentID. The inbox address becomes the account email at the app, and the app’s welcome, verification, and receipt emails land there.

**Do I have to approve every sign-in?**
No. AgentID’s FAQ says the agent signs in on its own and you keep control of its credentials and can revoke them. After the first approval at an app, AgentID remembers it for 180 days for that inbox and app. One exception: if an app asks for your name or email and the agent’s key is not allowed to share them, you approve that sign-in from your AgentMail account.

**Can an app read my agent’s email?**
No. Signing in shares the agent’s address so the app knows who it is. It does not let the app read or send the agent’s mail. The app can send email *to* the agent, like it would to any user.

**What does the app learn about me, the owner?**
Every sign-in gives the app the agent’s ID and verified email. With the `profile` scope the app also gets `owner_sub`, a random-looking owner ID that is the same for all your agents but does not include your name. Only registered apps that request the owner scopes get your actual name and email.

**How do I revoke an agent’s AgentID access?**
Delete the agent’s sign-in key in AgentMail (`DELETE /v0/api-keys/{api_key_id}`). That stops new sign-ins with that key at every app. Deleting the AgentMail API key that created it does not revoke the sign-in key. To stop the agent at just one app, disable that inbox’s account there with AgentMail’s Update Account call instead.

**Why is my agent still signed in after I revoked its key?**
Revoking stops new sign-ins, not sessions that already exist. AgentID sends no sign-out signal to apps. A token the app already received lasts up to 10 minutes, and the app’s own session lasts as long as the app decides. Sign out at the app, or wait for that session to end.

**Which apps accept AgentID?**
AgentMail’s launch post names Firecrawl, Turso, TinyFish, Manufact, Telnyx, and Rho, and points to the full list in the AgentID directory at agentid.com/directory. AgentMail says the directory is editorially curated.

**What if the app I need is not on AgentID?**
Then there is no AgentID sign-in for it. AgentMail’s docs suggest picking a listed app that does the same job, or signing up on the app’s own site with the agent’s inbox address and reading the verification email from that inbox. Their docs say assistants should not fill in third-party sign-up forms on their own.

**Does AgentID cost anything?**
AgentID’s site says it is free for apps that add the button. On your side, the agent needs an AgentMail inbox; AgentMail’s docs say it has a free tier with no credit card required. The app your agent signs in to sets its own prices.

**Can I use the app alongside my agent?**
AgentID’s FAQ says that if the app supports teams, the agent can invite you to a shared workspace with separate roles.

## Sources (read 7 October 2026)

- AgentMail newsletter, "AgentID is here: our biggest launch yet," 6 October 2026
- https://www.agentid.com/blog/introducing-agentid
- https://www.agentid.com/ and https://www.agentid.com/llms-full.txt
- https://www.agentid.com/blog/give-your-ai-agent-its-own-identity
- https://www.agentid.com/blog/revoking-an-ai-agents-access
- https://docs.agentmail.to/agentid-sign-in
- https://docs.agentmail.to/agentid-in-assistants

- Canonical HTML: https://agentlane.net/guides/sign-in-with-agentid/
- Related shelf: https://agentlane.net/resources/
- Site index: https://agentlane.net/llms.txt