Enable agent enrollment

Enrollment is Step 2 of the InFlow integration. With AEP, the Agent Enrollment Protocol, an agent enrolls with your service and gets its own credential. The agent uses that credential for ongoing access, under the policies of your service. See Enrollment with AEP for the terms. To build this with a coding agent, see Integrate with a coding agent.

Step 1: Choose an SDK

Language	GitHub repository
Go	`aep-foundation/aep-go`
Java	`aep-foundation/aep-java`
Node.js and TypeScript	`aep-foundation/aep-node`
Python	`aep-foundation/aep-python`
Rust	`aep-foundation/aep-rust`

The Python SDK is also on PyPI as agent-enrollment-protocol. It has four modules: core, agent, service, and platform.

Step 2: Publish the Service Document

Serve the AEP Service Document at /.well-known/aep on your origin. It tells agents how to enroll and which credential types your service issues. Credential types are grants, for example an API key, Basic authentication, or an OAuth bearer token. The baseline authentication header is Authorization: AEP <jwt>. Implement each command that the document advertises. Advertise only the commands and methods that you implement. For the document format, read the AEP documentation. For the normative rules, read the AEP specification.

Step 3: Keep your permissions

AEP adds a way for agents to enroll. It does not replace your access rules.

Keep the existing permissions of your application.
Ask for authentication on each protected operation.
Ask for authentication on a paid operation when that operation needs an account.

Step 4: Combine AEP with payments

An enrolled agent pays with InFlow Payments, through MPP or x402. The mpp-aep-seller-express example in the InFlow Node SDKs puts AEP enrollment in front of an MPP endpoint. See SDKs.

Step 5: Check enrollment

Run your service. Log in with inflow auth login. Make sure that the vault is unlocked. Then enroll as an agent does.

inflow aep inspect https://api.example.com
inflow aep enroll https://api.example.com --interval 5
inflow aep fetch https://api.example.com/protected
inflow aep status https://api.example.com

Command	Check
`aep inspect`	It reads your advertisement without authentication. Confirm that it lists the commands and the credential types that you implement.
`aep enroll`	It enrolls the agent. Approve the enrollment when the CLI shows an approval URL.
`aep fetch`	It calls a protected resource, and authenticates with AEP when your service challenges the request. Confirm that the response is correct.
`aep status`	It shows the lifecycle status of the enrollment.

See Discover and enroll for every flag.

Next step

Step 3: Make your products discoverable

Describe your offerings and actions with ODP, so that agents can find and buy them.

Overview

Pay as an agent

Integrate your service

Concepts

Reference

Enable agent enrollment

Step 1: Choose an SDK

Step 2: Publish the Service Document

Step 3: Keep your permissions

Step 4: Combine AEP with payments

Step 5: Check enrollment

Next step

Step 3: Make your products discoverable

​Step 1: Choose an SDK

​Step 2: Publish the Service Document

​Step 3: Keep your permissions

​Step 4: Combine AEP with payments

​Step 5: Check enrollment

​Next step

Step 3: Make your products discoverable

Step 1: Choose an SDK

Step 2: Publish the Service Document

Step 3: Keep your permissions

Step 4: Combine AEP with payments

Step 5: Check enrollment

Next step