Skip to main content
Enrollment is one of the three parts of InFlow, with Payments and Discovery. It uses the Agent Enrollment Protocol (AEP), an open protocol for agent enrollment, service-issued credentials, and authenticated agent access. Without AEP, a person registers an account for the agent and copies an API key. With AEP, the agent enrolls with the service and gets its own credential.

​
Terms

​
The enrollment flow

1

Inspect

The agent reads the AEP advertisement of the service. It lists the supported commands, methods, and credential types.
2

Enroll

The agent enrolls. InFlow can ask the owner to approve the enrollment.
3

Get a credential

The service issues a credential. The InFlow CLI stores it in the encrypted vault.
4

Call the service

The agent calls protected resources with the credential. The baseline authentication header is Authorization: AEP <jwt>.
An agent can also check the lifecycle status of an enrollment and revoke its credentials.

​
How AEP connects to ODP and payments

An agent often finds the service first with Discovery (ODP). An ODP action or a paid endpoint can need enrollment. For a paid endpoint, the InFlow CLI sends the AEP credential together with the payment credential.

​
Use AEP

​
SDKs and specification

AEP has SDKs for Go, Java, Node.js, Python, and Rust in the aep-foundation organization. The Python package is agent-enrollment-protocol on PyPI, with four modules: core, agent, service, and platform.
Last modified on October 15, 2026