--- title: "WorkOS × ZeroClick: Letting AI agents sign up and buy on their user's behalf | ZeroClick Blog" url: https://zeroclick.ai/blog/workos-letting-ai-agents-sign-up-and-buy-on-their-users-behalf fetched_at: 2026-11-04T20:52:02.678Z --- # ZeroClick API catalog and pricing ## API reference, endpoint lookup and prices **[ZeroClick API catalog: endpoints, request parameters, prices and payment methods](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/zeroclick/agent/guide).** Tell the seller advisor what you want to accomplish. It returns the matching operation contract, known prices, authentication prerequisites and concrete next steps. It is read-only: no login, wallet, card or purchase approval is needed to look up an API. It never executes a sale. Available API services: Agent readiness report, Demo booking. **Suggested next request:** GET [task guide](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/zeroclick/agent/guide?goal=URL_ENCODED_TASK). Use this URL directly with your web fetch tool; no preliminary document fetch is required. Include known inputs and desired output in the goal. Optional: quantity=API_CALL_COUNT, budgetUsd=TOTAL_USD, requirements=REQUIREMENTS, payment=x402|mpp|card, auth, identity, assertion and access state. Omit unknowns. Do not equate output items with API calls or guess a call count. For private task details or known request arguments, POST https://agents.zeroclick.ai/zcj/s6ke0j4huijl/zeroclick/agent/guide with Content-Type: application/json. Example: {"intent":"quote","goal":"YOUR_TASK","purchase":{"budgetUsd":"5.00"}}. Replace the task and budget with known facts; budgetUsd is a string. Include known buyerState, paymentCapabilities and arguments. For execution planning use intent=execute and the authorized constraints. Exact fields: [request schema](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/zeroclick/agent/schema). GET and POST are alternatives, not mandatory stages. The advisor describes a recommended happy path, not the only allowed path. You may use the API reference, buyer SKILL and your own tools directly, including for catalog operations with failed probes. Missing guidance or an unverified probe is not a policy refusal. The returned requests are documented API calls; fill in the documented inputs. Check usage cost AND minimum cash required against the budget. For needs_input, supply only missing facts. Keep secrets local, and never put credentials or private payloads in URLs. Unknown does not mean absent. For a human's credit or plan purchase, reuse an existing ZeroClick credential first. If the Link CLI is already installed and signed in for that person, you can use their Link account for identity as well as payment, sharing their email only if they agree: follow [Link identity setup](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/auth.md#link-identity-preview) through issuance, presentation, registration and token exchange. Otherwise register anonymously; no Link setup is needed, and the person can claim the identity later. Open the checkout URL in a browser: eligible Stripe pages support Link Pay Tokens (LPT) through WebMCP or the documented DOM flow. Follow this storefront's /payment/card.md to verify the same-frame token input and merchant binding before requesting an LPT. Token submission requires payment authorization. If unavailable, privately send the checkout URL to your human to pay. When the selected route uses hosted checkout, follow [card checkout instructions](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/payment/card.md) before requesting a token. LPT goes only to Stripe, never to the advisor or ZeroClick API. Poll the returned statusUrl before using credit or retrying delivery. Verify delivery; a payment or HTTP 202 is not completion. For an unexpected result, POST the original input and continuation (version, stepId, outcome and sanitized error/accessId/paymentId). Reconcile uncertain payments or writes before retrying. Use raw HTTP for exact schemas and authenticated execution; do not reconstruct fields omitted by a summarizing web tool. The human subscription prices on the requested page describe a separate channel. Use the API quote for per-unit pricing, funding minimums and commercial terms; tier names do not prove quality or licensing. For an alternative documented path, use the [buyer SKILL](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/SKILL.md) or [full direct workflow reference](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/llms-full.txt). Confirm missing request details from seller documentation, stay within the existing catalog and what your user asked for, and respect actual access and payment requirements. Terms: by completing a purchase through this endpoint, whether directly or through an AI agent acting on your behalf, you agree to be bound by the platform's buyer terms of service (https://www.zeroclick.ai/legal/buyer-terms-of-service). If the purchase is made by an agent, you represent and warrant that the agent is acting with your authorization, and you agree that the agent's actions, including its acceptance of these terms, are attributed to you and bind you as if you had taken them yourself. Paying a 402 challenge completes the purchase and constitutes your affirmative acceptance of the terms linked above. The link travels in every payment challenge and receipt as `terms`. # WorkOS × ZeroClick: Letting AI Agents Sign Up and Buy on Their User's Behalf **Blog** · November 3, 2026 · 7 min read · Collaboration **Author:** Spencer Charest, Software Engineer --- - [Why selling to agents gets hard after the first request](#why-selling-to-agents-gets-hard-after-the-first-request) - [What sellers get with an Agent Storefront](#what-sellers-get-with-an-agent-storefront) - [How it works](#how-it-works) - [One front door, more than one kind of identity](#one-front-door-more-than-one-kind-of-identity) - [Get started](#get-started) An AI agent can pay for a single API call on its own: a search, a quote, an image. The moment it wants more, like a credit pack, a monthly plan, or a free tier, it needs an account, and accounts were built for people. Either the person behind the agent stops to sign up by hand, or the sale doesn't happen. [WorkOS](https://workos.com) wrote [auth.md](https://workos.com/auth-md), an open protocol that lets an agent register for a service on its user's behalf. ZeroClick builds Agent Storefronts so businesses can sell to AI agents and get paid. This post explains how the two work together. Every Agent Storefront powered by ZeroClick runs on auth.md and WorkOS AuthKit, so agents can sign up, pay, and return to what they bought, and sellers do not have to build any of it. ## Why Selling to Agents Gets Hard After the First Request Paying per request never needed an account, and Agent Storefronts have handled it from the start: an agent calls a priced endpoint, pays in stablecoins or by card, and gets its result. Credits, plans, and API keys are different. Selling them means knowing who is asking and recognizing them again tomorrow, on another machine, from another agent working for the same person. Without a standard for that, every seller had to invent its own. ## What Sellers Get with an Agent Storefront **Agents that sign up on their own.** An agent registers through the auth.md file on your domain, with no signup form. If its user is signed in with an identity provider the storefront trusts, the agent can set up access for that person without them ever signing up for your service. **Customers who keep what they buy.** Once a person claims their agent's credential, what it bought belongs to them, not to one agent or one laptop. Plans and credit packs work for agents the way they do for people. One credential also works at every ZeroClick storefront, so an agent that has bought anywhere on the network can buy from you without registering again. **Nothing to build.** The file is served on your domain, in your name. ZeroClick and WorkOS run everything behind it. Your API keeps doing what it already does: checking that each request came through ZeroClick and reading a stable buyer ID for each customer, with no keys to issue and no auth model to change. ## How It Works *[workos.com/auth-md](https://workos.com/auth-md)* **The protocol.** auth.md is an open protocol for agents to register with services. At its core, it is a Markdown file at the root of a service that an agent reads the way it reads a README: how to register, how to link the registration to its user, and how to get an access token. WorkOS launched it in May. Cloudflare, Neon, Firecrawl, Resend, and a [growing list of others](https://workos.com/auth-md), ZeroClick among them, already publish one. auth.md supports several registration flows, and each service decides which to offer: - **Anonymous.** One call, no email, no human step. The agent can start right away and be claimed later. - **Email.** The agent registers with its user's email, the person reads a one-time code back to it, and the account is theirs. - **Identity assertion.** The agent's identity provider signs a short-lived token, an ID-JAG, saying "this agent is acting for this person." The service validates the ID-JAG, and the account is theirs from the start, with no form and no code. **How we built on it.** auth.md describes how agents discover and complete registration. ZeroClick builds on that protocol with shared identity infrastructure, seller integrations, and purchase tracking across our storefront network. Every storefront has its own auth.md on the seller's domain, like [zeroclick.affiliate.com/auth.md](https://zeroclick.affiliate.com/auth.md), offering all three flows above plus a fourth we added for Stripe's Link Agent Wallet, covered below. Behind those files, we use WorkOS AuthKit's [Agent Registration](https://workos.com/docs/authkit/agent-registration) to issue credentials and tokens. We validate the ID-JAGs, keep the list of trusted identity providers, and serve each seller's file. Because every ZeroClick storefront shares that setup, one registration works across our network. When a provider joins our trust list, its users' agents can sign in at every storefront the same day. The first was [Zero](https://zero.xyz), our agent-side platform. Our [short walkthrough](https://cdn.withzero.xyz/ZrV1lavt/zeroclick-workos-demo-zcui/) on Affiliate.com's storefront shows two of those flows: an agent registers with our email flow and buys a fifty-cent credit pack, then a new agent on another machine signs in with an ID-JAG from Zero in one command and finds the six cents left over waiting for it. ## One Front Door, More Than One Kind of Identity There will not be a single answer to agent identity, because different use cases have different identity needs. When an agent needs ongoing access to a service on its user's behalf, the hard part is setting that up without the person having to sign up. That is delegated service access, and it is what ID-JAG is built for. When the job is a one-time purchase, what often matters is verified details about the person, much like a guest checkout. That is what identity in Stripe's [Link Agent Wallet](https://link.com/agents), currently in beta, is built for. Because auth.md is open, a storefront does not have to choose. We extended our implementation with a fourth flow for Link identity, in preview at every ZeroClick storefront since early October, so sellers can welcome agents that arrive with Link without building anything new. Whichever way an agent arrives, it ends up with the same kind of credential through WorkOS AuthKit. > "In the same way OAuth made social login seamless, we believe ID-JAG is going to make agent identity across any identity provider seamless. Link answers who's the human behind an agent, and auth.md with ID-JAG answers how that agent gets ongoing access to a service without the human having to set it up. Our sellers end up needing both." > > — Spencer Charest, Software Engineer at ZeroClick > "We made auth.md an open protocol so services don't have to think about how agents sign up for their products. ZeroClick shows what that unlocks: identity and payments handled together, across a whole network of storefronts. Together, we're committed to making two of the hardest problems in selling to agents disappear, so services can get back to building their products." > > — Madison Packer, Full-stack Engineer at WorkOS ## Get Started **If you build agents,** fetch /auth.md from any ZeroClick storefront, such as [agents.zeroclick.ai/auth.md](https://agents.zeroclick.ai/zcj/s6ke0j4huijl/auth.md), and follow it. WorkOS's [auth.md docs](https://workos.com/auth-md/docs) cover the protocol. Services that want agents to register directly can use [Agent Registration](https://workos.com/docs/authkit/agent-registration) in WorkOS AuthKit. **If you run an identity provider,** mint ID-JAGs for your users with WorkOS's [agent provider guide](https://workos.com/auth-md/docs/agent-providers), then write to [help@zeroclick.ai](mailto:help@zeroclick.ai). We want to add you to our trust list so your users' agents can sign in at every ZeroClick storefront. **If you want to sell your product to AI agents,** get a demo at [zeroclick.ai](https://zeroclick.ai/getlisted?utm_source=blog) or read the docs at [docs.zeroclick.ai](https://docs.zeroclick.ai).