Your users will stop filling out forms.
Apps host a tiny file. Agents read it and sign your users up. No form.
A real account is created for you by an agent — using the same open auth.md protocol you'll ship.
Three files. Zero forms.
Host the file
Drop a tiny auth.md + two .well-known files on your domain. That's the whole integration.
Agents discover it
Any agent reads the protocol, learns how to register and claim accounts for a human.
Users arrive provisioned
Your users show up already signed up — an agent did it for them. No form, ever.
Drops into your stack
Host three static files, then validate the agent-issued credential with a few lines. Plain HTTP — no SDK lock-in.
acme.noform.dev →
A real third-party app integrated with NoForm. Paste its snippet into your agent and watch it sign you up — then it greets you, verified. This is the whole product, working.
// validate the agent's credential const user = await introspect(cred) // → { active, email, scopes } if (user.active) startSession(user.email) // they're in. no form.
Why it's different — and why it's safe
“Sign up with no form” only works if it can't be abused. NoForm makes agent-driven signup real and accountable.
Real email verification, not fake accounts
An agent can't conjure a user out of thin air. It must claim a human's email and pass a one-time code sent to that inbox — so every account is a real person who consented.
Real users, no shadow records
Provisioned accounts are first-class, email-verified users in your own system — ready for your sessions, MFA and billing, not a side table to reconcile later.
An open protocol, not an SDK lock-in
auth.md is an open agent-registration protocol — just three static files and plain HTTP. Any agent (ChatGPT, Claude, your own) can read it. Host it anywhere, leave anytime.
Governance is the product, not an afterthought
Per-IP and per-tenant rate limits, monthly caps, disposable-email blocking and velocity scoring — with a live audit log of every event. You set the dials.
Verified agents, cryptographically
Trust specific agent platforms by their signing keys (JWKS). Their signed, replay-protected requests skip the human step — everyone else takes the safe path.
Private by design
No passwords pass through NoForm. Credentials are hashed, claims expire, and any registration can be revoked. You own the caps and the kill switch.
Simple pricing
Start free. Upgrade when an agent is signing up real users for you.
Free
Launch one agent-ready app, hosted on noform.dev.
- ✓1 app
- ✓User-claimed (email) flow
- ✓Hosted on noform.dev/a/…
- ✓~250 agent signups / mo
- ✓NoForm-branded
Builder
$24/mo billed annually
Your own domain, de-branded, with room to grow.
- ✓Up to 5 apps
- ✓Custom domain
- ✓Agent-verified / ID-JAG flow
- ✓Configurable governance + audit retention
- ✓~10k signups / mo
- ✓De-branded
Scale
High volume, team seats, and priority support.
- ✓Unlimited apps
- ✓High caps + abuse controls
- ✓Team seats
- ✓Priority support
Paid plans are billed securely. Manage or upgrade anytime from your dashboard.