> ## Documentation Index
> Fetch the complete documentation index at: https://ifdocdemo.lumivescence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enrollment with AEP

> How agents enroll with services and get their own credentials with the Agent Enrollment Protocol.

Enrollment is one of the three parts of InFlow, with [Payments](/concepts/payments) and [Discovery](/concepts/discovery). It uses the Agent Enrollment Protocol (AEP), an open protocol for agent enrollment, service-issued credentials, and authenticated agent access.

Without AEP, a person registers an account for the agent and copies an API key. With AEP, the agent enrolls with the service and gets its own credential.

## Terms

| Term | Meaning |
| - | - |
| Agent | The software that enrolls with a service and authenticates to it. |
| Service | The system that issues credentials and authenticates agents. |
| Enrollment | The process in which an agent registers with a service. |
| Credential | A token that the service issues to the agent. |
| Grant | The mechanism that issues a credential. Examples are an API key, Basic authentication, and an OAuth bearer token. |
| Platform | A hosted identity provider. It gives delegated signing and identity custody. |

## The enrollment flow

<Steps>
  <Step title="Inspect">
    The agent reads the AEP advertisement of the service. It lists the supported commands, methods, and credential types.
  </Step>

  <Step title="Enroll">
    The agent enrolls. InFlow can ask the owner to approve the enrollment.
  </Step>

  <Step title="Get a credential">
    The service issues a credential. The InFlow CLI stores it in the encrypted vault.
  </Step>

  <Step title="Call the service">
    The agent calls protected resources with the credential. The baseline authentication header is `Authorization: AEP <jwt>`.
  </Step>
</Steps>

An agent can also check the lifecycle status of an enrollment and revoke its credentials.

## How AEP connects to ODP and payments

An agent often finds the service first with [Discovery](/concepts/discovery) (ODP). An ODP action or a paid endpoint can need enrollment. For a paid endpoint, the InFlow CLI sends the AEP credential together with the [payment](/concepts/payments) credential.

## Use AEP

| You are | Start here |
| - | - |
| An agent | [Discover and enroll](/agents/discover-and-enroll#enroll-with-a-service) |
| A seller | [Step 2: Enable enrollment](/sellers/enable-enrollment) |

## SDKs and specification

AEP has SDKs for Go, Java, Node.js, Python, and Rust in the [aep-foundation](https://github.com/aep-foundation) organization. The Python package is `agent-enrollment-protocol` on PyPI, with four modules: core, agent, service, and platform.

| Resource | Link |
| - | - |
| Documentation | [aep.foundation/documentation](https://www.aep.foundation/documentation/) |
| Specification | [aep.foundation/protocol](https://www.aep.foundation/protocol/) |
| API-key session credential grant | [aep.foundation/draft/api-key-session-credential](https://www.aep.foundation/draft/api-key-session-credential/) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.