Skip to main content
ACP authentication is negotiated during initialization. Agents advertise available authentication methods in authMethods. A non-empty list makes auth/login and auth/logout available, while each authentication method type defines whether the Client invokes auth/login.

​
Advertising Authentication

Agents advertise authentication options in the authMethods field of the initialize response. Each method has a methodId. The Client passes that ID to auth/login only when the method’s type defines a protocol-driven login flow. Returning one or more valid entries in authMethods advertises the authentication surface. An Agent that does so MUST implement both auth/login and auth/logout. If authMethods is omitted or empty, the Agent does not advertise this surface and Clients MUST NOT call either method. capabilities.auth is orthogonal to this requirement. It advertises authentication-related extensions, not the availability of the baseline auth/login and auth/logout methods.
Because this response contains an agent authentication method, the Agent must support both auth/login and auth/logout.

​
Authentication Method Types

The standard authentication method type is agent, where the Agent handles authentication through auth/login. Every authentication method must include a type discriminator:
Authentication method type values can be custom or future variants. Custom method types MUST begin with _. Unknown non-underscore method types are reserved for future ACP variants. Clients that do not understand a method type should preserve the raw method payload when storing, replaying, proxying, or forwarding initialization data, and otherwise ignore the method or display it generically. See the schema for the full stable AuthMethod definition.

​
Authenticating

When an Agent requires authentication and the selected method’s type defines a protocol-driven login flow, the Client calls auth/login with that advertised method’s ID:
​
string
required
The ID of an advertised authentication method whose type defines the auth/login flow.
On success, the Agent returns an empty result:
After successful authentication, the Client can create new sessions without receiving an auth_required error for authentication-gated requests.

​
Logging Out

The auth/logout method allows Clients to end the current authenticated state. Clients may call it only when the Agent advertised one or more valid authentication methods during initialization; there is no separate logout capability marker.
On success, the Agent returns an empty result:
After a successful auth/logout, authentication-gated requests will require the user to complete one of the advertised authentication flows again.

​
Active Sessions

The protocol does not guarantee what happens to already-running sessions after auth/logout. Agents may terminate them, keep them running, or return auth_required errors for future session activity. Clients SHOULD be prepared for active session operations to fail with authentication-related errors after logout and should prompt the user to authenticate again when appropriate.