---
title: "Human Studio — Agent Authentication Specification"
description: "WorkOS auth.md compliant specification for autonomous AI agent authentication, public tier, discovery and credentials."
canonical: "https://humanstudio.com.ar/auth.md"
last-updated: "2026-08-29"
---

# Human Studio Agent Authentication Specification (auth.md)

> This document follows the **WorkOS auth.md** standard for autonomous AI agent authentication, OAuth protected resources, and self-serve access to Human Studio's digital service endpoints.

## 1. Discover (Protected Resource Metadata)
- **Resource Server**: `https://new.humanstudio.com.ar`
- **Protected Resource Metadata (RFC 9728)**: `https://new.humanstudio.com.ar/.well-known/oauth-protected-resource`
- **Authorization Server Metadata (RFC 8414)**: `https://new.humanstudio.com.ar/.well-known/oauth-authorization-server`
- **Agent Instruction Anchor**: `agent_auth`
- **WWW-Authenticate Hint**: `Bearer resource_metadata="https://new.humanstudio.com.ar/.well-known/oauth-protected-resource"`

## 2. Pick a Method
Human Studio supports two frictionless authentication methods:
- **Public Zero-Friction Tier (`anonymous`)**: Full read access to `/api/v1/services` and `/api/v1/projects` with standard RFC RateLimit headers (120 req/min).
- **Bearer Token (`identity_assertion`)**: Header token authorization for quote dispatch and CRM webhook subscriptions.

## 3. Register (`register_uri`)
- **Registration Endpoint**: `https://new.humanstudio.com.ar/api/v1/agent/register`
- **Sandbox Test Key**: `sandbox_test_humanstudio_2026`
- **Supported Identity Types**: `anonymous`, `identity_assertion`

## 4. Claim (`claim_uri`)
- **Claim Endpoint**: `https://new.humanstudio.com.ar/api/v1/agent/claim`

## 5. Use the Credential
Pass the Bearer token in the standard Authorization header:
```http
GET /api/v1/services HTTP/1.1
Host: new.humanstudio.com.ar
Authorization: Bearer sandbox_test_humanstudio_2026
Accept: application/json
```

## 6. Errors & Resolution
All errors return structured JSON conforming to RFC 7807:
```json
{
  "error": "UNAUTHORIZED",
  "message": "Invalid or missing credentials. See https://new.humanstudio.com.ar/auth.md for resolution hints.",
  "status": 401,
  "resolution_hint": "Supply Authorization: Bearer sandbox_test_humanstudio_2026 or request self-serve key"
}
```

## 7. Revocation (`revocation_uri`)
- **Revocation Endpoint**: `https://new.humanstudio.com.ar/api/v1/agent/revoke`

## 8. Official CLI Tool (Command Line Interface)
For agents and developers scripting interactions directly without writing API boilerplate:
```bash
# Install via npm
npx @humanstudio/cli services list
npx @humanstudio/cli projects search --industry metalurgica
npx @humanstudio/cli quote request --company "Empresa SAS" --email "info@empresa.com"

# Or install globally
npm install -g @humanstudio/cli
humanstudio ask "Qué servicios ofrece Human Studio para industrias?"
```

## 9. REST API Versioning & Deprecation Policy
- **Current Version**: `v1` (`/wp-json/api/v1/...`)
- **Versioning Mechanism**: Path-based URL versioning (`/api/v1/`) and `API-Version: 1.0` header.
- **Sunset Policy**: No breaking changes or deprecations are scheduled before **December 31, 2028**.
- **Deprecation Warning**: When a major version enters sunset mode, Human Studio emits standard `Sunset: <date>` and `Deprecation: @<timestamp>` headers with at least 180 days advance notice.