外掛標籤
開發者團隊
② 後台搜尋「AgentKey Sign-In for AgentID」→ 直接安裝（推薦）
原文外掛簡介
AI agents increasingly need accounts at the sites their owners use. The usual options are bad ones: share the owner’s password, scrape a session cookie, or give up. AgentID is a sign-in service built for AI agents (by the AgentMail team): an agent gets its own verified identity, and every sign-in carries a signed statement of who the agent is and which human owns it.
This plugin adds Sign in with AgentID to your site, so agents can authenticate the clean way — as themselves, with their owner accountable — while you keep control of what an agent account may do.
Credit: AgentID is a product of AgentMail. This plugin is an independent, community-built integration that exists to make AgentID easier to adopt on WP and WooCommerce. It is not affiliated with, endorsed by, or sponsored by AgentMail, and it does not replace any part of their product — your site still uses your own AgentID application, on their service, under their terms.
AgentID on the web: https://www.agentid.com — AgentMail/AgentID on GitHub: https://github.com/agentmail-to
Disclaimer
AgentKey Sign-In for AgentID is an independent, open-source community project. It is not made by, affiliated with, endorsed by, or sponsored by AgentMail, and it is not an official AgentID product. AgentID and AgentMail are trademarks of their respective owners; both names are used in this plugin and its documentation only to describe the service the plugin connects to. Support for this plugin comes from its own community, not from AgentMail.
How it works
You create a free application for your site in the AgentID console (console.agentid.com) — one application per site, registered by you, because only you can register your site.
You paste the Client ID (and secret, if any) into this plugin’s settings and register the redirect URI the plugin shows you.
Agents clicking “Sign in with AgentID” are sent through AgentID’s standard OpenID Connect flow (authorization code + PKCE). This plugin verifies the signed ID token against AgentID’s published keys, then signs the agent in to its own WP account on your site.
What you get
Sign-in button on the WP login form and the WooCommerce login form, plus an [agentid_login] shortcode and a Gutenberg block for anywhere else.
Automatic account creation (“just-in-time provisioning”) for agents on first sign-in, keyed to the agent’s stable AgentID identity — never by email alone.
Agent identity details (agent ID, owner name and email when AgentID returns them) stored on the account and shown on its profile.
Owners can link their agent from their own profile, so the agent’s account on your site records who owns it.
A guided settings page with a copy-paste redirect URI and a live connection test.
Safety defaults (built in, not upsells)
Agent accounts can never be provisioned with a role that grants site- or store-administration capabilities (WooCommerce shop management included) — and if one is ever promoted to such a role, it is demoted at its next sign-in.
When an agent’s owner is recorded, its capabilities are capped at the owner’s; site-administration capabilities are denied to every agent account regardless.
While this plugin is active, agent accounts cannot sign in with a password, reset a password, or use application passwords — AgentID is the only sign-in path left open to them.
Agent sessions are short (12 hours by default, configurable 1–72), because revoking an agent at AgentID stops new sign-ins but does not end sessions a site has already issued.
External services
This plugin connects to the AgentID service (operated by AgentMail) to authenticate agents. This connection is the plugin’s core function: without it, there is no sign-in to verify.
Service: AgentID — https://www.agentid.com — documentation: https://www.agentid.com/docs
Endpoints used, all under https://auth.agentid.com: the OpenID Connect discovery document (/.well-known/openid-configuration), the authorization endpoint (/v0/authorize), the token endpoint (/v0/token), the JWKS endpoint (/v0/jwks.json), and the userinfo endpoint (/v0/userinfo).
Data sent: when a visitor starts an AgentID sign-in, the browser is redirected to AgentID with this site’s client ID, the requested scopes, the redirect URI registered for this site, and single-use state/nonce/PKCE challenge values. The resulting authorization code is then exchanged directly between this site’s server and AgentID’s token endpoint: that exchange sends the authorization code, the PKCE code verifier, the redirect URI, and — for applications with a client secret — the client ID and client secret, sent as HTTP Basic authentication. When the application requests user information, the site then calls the userinfo endpoint presenting the resulting access token. No site content, user database, or browsing data is sent.
Admin test: when an administrator clicks “Test connection” in this plugin’s settings, the site’s server requests the discovery document and signing keys from AgentID to verify the connection. No user or site data is included — the request carries only what any HTTPS request necessarily carries, such as the server’s IP address. The discovery document and keys are also cached briefly by the sign-in flow itself.
Data received: the signed ID token (and userinfo response) for the signing-in agent: agent ID, agent email, and — for registered applications that request the owner scopes — the owner’s name and email. The fields the site keeps are listed under Privacy.
AgentID’s terms of service: https://www.agentid.com/legal/terms — AgentID’s privacy policy: https://www.agentid.com/legal/privacy. Confirm the current documents there before registering your application.
Privacy
This plugin does not track visitors, does not phone home, and contains no analytics.
For agent accounts it creates or signs in, the plugin stores these user meta fields from the verified AgentID sign-in: agent subject ID, actor type, agent email, owner subject ID, owner name, owner email, the linked owner account ID when matched, and the time of the last sign-in. The account email is chosen at provisioning: the agent’s verified email when AgentID returns one, otherwise a synthetic placeholder address derived from the agent’s subject ID on a non-deliverable domain. The account email is not changed on later sign-ins. When a site user links an agent from their profile, the agent’s subject ID is also stored on that user’s account (the linked-subject field). During a sign-in, the plugin sets a short-lived browser cookie (10 minutes) that binds the flow to the browser, and stores the flow state in a transient for the same period; the transient is deleted on first use and the cookie expires with the flow. Tokens issued by AgentID are never stored; the client secret you enter is stored in the site’s options table, like other SSO credentials, and is never displayed after saving.
Suggested privacy-policy text: “If you sign in with AgentID, we receive your agent identity and your owner’s name and email from AgentID (operated by AgentMail) and store them with your account so we can identify you and your owner.”
