Security: store-management roles (e.g. WooCommerce Shop manager) can no longer be assigned to agent accounts, retained accounts rejoin at the default role after a reinstall, and the sign-in security model is documented in the FAQ. Recommended.<\/p>","0.1.5":"
Renamed to AgentKey Sign-In for AgentID at the WordPress.org review team's request \u2014 the old name was too descriptive. Nothing else changes: settings, linked agents and accounts carry over exactly. Recommended for all sites.<\/p>","0.1.4":"
Hardening release: identity data from the userinfo endpoint is now merged through a type-checked whitelist so it can never override verified token claims, and a malformed discovery document fails cleanly instead of erroring. Recommended for all sites.<\/p>","0.1.3":"
Quality fixes from an external review: sign-in works where the core path differs from the home path, credentials with special characters survive saving and token exchange, and retained agent accounts reconnect after a reinstall. Recommended for all sites.<\/p>","0.1.2":"
Renamed to Agentic Agent SSO. The Gutenberg block now loads correctly in the editor, agent accounts are denied the full set of site-administration capabilities (not just one), and explicitly linked agents always receive their owner's capability ceiling. Recommended for all sites.<\/p>","0.1.1":"
Security hardening release: unconditional denial of site-administration capability for agent accounts, stricter ID token validation, and multisite-safe uninstall.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3760606,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3760606,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3760606,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3760606,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":{"agentkey-sign-in-agentid\/login-button":{"$schema":"https:\/\/schemas.wp.org\/trunk\/block.json","apiVersion":3,"attributes":{"label":{"default":"","type":"string"}},"category":"widgets","description":"A 'Sign in with AgentID' button for verified AI agents.","editorScript":"file:.\/index.js","icon":"id-alt","name":"agentkey-sign-in-agentid\/login-button","style":"file:.\/..\/..\/assets\/css\/agentid-login.css","textdomain":"agentkey-sign-in-agentid","title":"AgentID Login Button","version":"0.1.6"}},"tagged_versions":["0.1.6"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3760606,"resolution":"1","location":"assets","locale":"","width":1440,"height":1205},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3760606,"resolution":"2","location":"assets","locale":"","width":1440,"height":1000},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3760606,"resolution":"3","location":"assets","locale":"","width":1440,"height":1000},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3760606,"resolution":"4","location":"assets","locale":"","width":1440,"height":1000},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3760606,"resolution":"5","location":"assets","locale":"","width":1440,"height":1000}},"screenshots":{"1":"Settings \u2192 AgentKey Sign-In for AgentID: the setup wizard walks through creating your AgentID application, registering the redirect URI, and testing the connection.","2":"\"Sign in with AgentID\" on the WordPress login form. The button is added to the WooCommerce login form too when WooCommerce is active.","3":"Link an agent to your account from your profile. The agent still gets its own account \u2014 it never signs in as you.","4":"An agent account in the admin: its AgentID identity and human owner on record. Passwords, password resets and application passwords are disabled for it.","5":"The AgentID Login Button block in the editor, ready to place on any page. Also available as the [agentid_login] shortcode."}},"plugin_section":[],"plugin_tags":[246305,162353,43290,2469,286],"plugin_category":[45],"plugin_contributors":[287966],"plugin_business_model":[],"class_list":["post-388152","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-agents","plugin_tags-oidc","plugin_tags-openid-connect","plugin_tags-sso","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-mpmike","plugin_committers-mpmike"],"banners":{"banner":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/banner-772x250.png?rev=3760606","banner_2x":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/banner-1544x500.png?rev=3760606","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/icon-128x128.png?rev=3760606","icon_2x":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/icon-256x256.png?rev=3760606","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/screenshot-1.png?rev=3760606","caption":"Settings \u2192 AgentKey Sign-In for AgentID: the setup wizard walks through creating your AgentID application, registering the redirect URI, and testing the connection."},{"src":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/screenshot-2.png?rev=3760606","caption":"\"Sign in with AgentID\" on the WordPress login form. The button is added to the WooCommerce login form too when WooCommerce is active."},{"src":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/screenshot-3.png?rev=3760606","caption":"Link an agent to your account from your profile. The agent still gets its own account \u2014 it never signs in as you."},{"src":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/screenshot-4.png?rev=3760606","caption":"An agent account in the admin: its AgentID identity and human owner on record. Passwords, password resets and application passwords are disabled for it."},{"src":"https:\/\/ps.w.org\/agentkey-sign-in-agentid\/assets\/screenshot-5.png?rev=3760606","caption":"The AgentID Login Button block in the editor, ready to place on any page. Also available as the [agentid_login] shortcode."}],"raw_content":"\n
AI agents increasingly need accounts at the sites their owners use. The usual options are bad ones: share the owner's password, scrape a session cookie, or give up. AgentID is a sign-in service built for AI agents (by the AgentMail team): an agent gets its own verified identity, and every sign-in carries a signed statement of who the agent is and which human owns it.<\/p>\n\n
This plugin adds Sign in with AgentID<\/strong> to your site, so agents can authenticate the clean way \u2014 as themselves, with their owner accountable \u2014 while you keep control of what an agent account may do.<\/p>\n\n Credit:<\/strong> AgentID is a product of AgentMail. This plugin is an independent, community-built integration that exists to make AgentID easier to adopt on WP and WooCommerce. It is not affiliated with, endorsed by, or sponsored by AgentMail, and it does not replace any part of their product \u2014 your site still uses your own AgentID application, on their service, under their terms.\nAgentID on the web: https:\/\/www.agentid.com \u2014 AgentMail\/AgentID on GitHub: https:\/\/github.com\/agentmail-to<\/p>\n\n AgentKey Sign-In for AgentID is an independent, open-source community project. It is not<\/strong> made by, affiliated with, endorsed by, or sponsored by AgentMail, and it is not an official AgentID product. AgentID and AgentMail are trademarks of their respective owners; both names are used in this plugin and its documentation only to describe the service the plugin connects to. Support for this plugin comes from its own community, not from AgentMail.<\/p>\n\n This plugin connects to the AgentID service (operated by AgentMail) to authenticate agents. This connection is the plugin's core function: without it, there is no sign-in to verify.<\/p>\n\n This plugin does not track visitors, does not phone home, and contains no analytics.<\/p>\n\n For agent accounts it creates or signs in, the plugin stores these user meta fields from the verified AgentID sign-in: agent subject ID, actor type, agent email, owner subject ID, owner name, owner email, the linked owner account ID when matched, and the time of the last sign-in. The account email is chosen at provisioning: the agent's verified email when AgentID returns one, otherwise a synthetic placeholder address derived from the agent's subject ID on a non-deliverable domain. The account email is not changed on later sign-ins. When a site user links an agent from their profile, the agent's subject ID is also stored on that user's account (the linked-subject field). During a sign-in, the plugin sets a short-lived browser cookie (10 minutes) that binds the flow to the browser, and stores the flow state in a transient for the same period; the transient is deleted on first use and the cookie expires with the flow. Tokens issued by AgentID are never stored; the client secret you enter is stored in the site's options table, like other SSO credentials, and is never displayed after saving.<\/p>\n\n Suggested privacy-policy text: \"If you sign in with AgentID, we receive your agent identity and your owner's name and email from AgentID (operated by AgentMail) and store them with your account so we can identify you and your owner.\"<\/p>\n\n\n For applications, yes \u2014 AgentID does not charge sites per sign-in. You register your own application and there is no usage pricing. This plugin is also free and open source.<\/p><\/dd>\n No \u2014 and no plugin could. Registering an application asserts ownership of a site, so it has to be done by the site owner in their own AgentID console account. The plugin's job is to make everything on the WP side a copy-paste.<\/p><\/dd>\n No. The agent gets its own account on your site. The account records who the owner is (when AgentID returns owner details), and its permissions are capped at the owner's when one is recorded \u2014 but the agent never receives the owner's credentials or session.<\/p><\/dd>\n It can no longer start new sign-ins. A session your site already issued runs until it expires, which is why this plugin keeps agent sessions short by default.<\/p><\/dd>\n Yes. With WooCommerce active, the button also appears on the WooCommerce login form, and agent accounts are ordinary WP users, so customer-role provisioning and My Account work as expected. HPOS compatibility is declared. Store-management roles (such as Shop manager) count as administration roles for agents and cannot be assigned to agent accounts.<\/p><\/dd>\n Uninstall keeps the agent user accounts (they belong to your site) but removes their AgentID identity data. On reinstall, an agent whose account used a placeholder email address reconnects to its retained account automatically on its next sign-in, rejoining at the site's configured default role for agent accounts \u2014 the placeholder is derived from the agent's immutable ID, so it can only match that agent's own account. An agent whose account used a verified email address cannot be matched automatically (an agent is never signed in to an existing account by email alone); an administrator can reconnect it by adding the agent's subject ID as the WordPress sessions belong to user accounts, so a verified agent identity needs a local account to hold its session, role and sign-in record \u2014 the same reason other SSO integrations provision accounts. An account is created only after AgentID's signed ID token passes verification (signature, issuer, audience, expiry, nonce, and an actor_type of \"agent\"; every check fails closed), and accounts are matched by the agent's immutable AgentID subject ID, never by email. The account receives the site owner's configured default role only when that role grants none of the plugin's hard-denied site- and store-administration capabilities; otherwise the least-privileged stock role is used, and if no safe role exists, provisioning is refused. While the plugin is active, those capabilities stay denied to the account whatever role it holds, and the account cannot use passwords, password resets, or application passwords. One boundary to know: sign-in completes through the plugin's OIDC callback, which issues the standard WordPress auth cookie and fires the standard wp_login action, but does not run the authenticate filter chain \u2014 login-policy plugins that enforce rules only inside that filter do not apply to AgentID sign-ins.<\/p><\/dd>\n No. It is an independent community integration, built on AgentID's public documentation. AgentID and AgentMail are trademarks of their respective owners.<\/p><\/dd>\n\n<\/dl>\n\n\nDisclaimer<\/h4>\n\n
How it works<\/h4>\n\n
\n
What you get<\/h4>\n\n
\n
[agentid_login]<\/code> shortcode and a Gutenberg block for anywhere else.<\/li>\nSafety defaults (built in, not upsells)<\/h4>\n\n
\n
External services<\/h3>\n\n
\n
Privacy<\/h3>\n\n
\n
client_secret_basic<\/code>, and require PKCE (S256).<\/li>\n\n
Is AgentID free?<\/h3><\/dt>\n
Can you register my site with AgentID for me?<\/h3><\/dt>\n
Does an agent sign in as its owner?<\/h3><\/dt>\n
What happens if an agent is revoked at AgentID?<\/h3><\/dt>\n
Does this work with WooCommerce?<\/h3><\/dt>\n
What happens to agent accounts if I uninstall and reinstall?<\/h3><\/dt>\n
agentid_sub<\/code> user meta on the retained account, or delete the retained account and let it be re-created on the next sign-in.<\/p><\/dd>\nWhy does the plugin create a user account when an agent signs in?<\/h3><\/dt>\n
Is this an official AgentMail plugin?<\/h3><\/dt>\n
0.1.6<\/h4>\n\n
\n
0.1.5<\/h4>\n\n
\n
0.1.4<\/h4>\n\n
\n
0.1.3<\/h4>\n\n
\n
0.1.2<\/h4>\n\n
\n
0.1.1<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n