How to make your SaaS sign-up work for AI agents
A SaaS sign-up is agent-ready when an AI agent acting for a person can get from your homepage to a working account with the person stepping in only to approve: it finds a sign-up link, reads public pricing, opens the form without a bot challenge, fills fields it can identify, and gets through verification with a code or link the person relays, not a CAPTCHA. A free plan or trial with no card up front lets the agent show the product works before anyone pays.
From our data: As of 3 Nov 2026, 143 of the 214 software vendors in our rankings linked a sign-up page from the homepage, and for 24 of them that page didn't open for an AI user-agent. 165 linked a pricing page. In our hand-checked deep dives, 9 of 64 developer platforms let an agent reach a working API key with no human step.
What the agent needs, in order
Public pricing page
Publish a pricing page with real numbers in the HTML. "Contact us" pricing is a dead end for an agent.
A self-serve sign-up link
Link a sign-up page from the homepage. Agents can't book a demo for a user.
Sign-up page opens for agents
Don't block AI user-agents from the sign-up page. Rate-limit accounts instead of hiding the form.
A free plan or trial
Offer a free plan or trial so an agent can show a user the product works before anyone pays.
No card needed to start
Let people start without a card, and say "no credit card required" on the page.
SoftwareApplication data
Add SoftwareApplication JSON-LD with applicationCategory and an Offer for each plan.
The gates that stop agents
CAPTCHAs and bot challenges
An agent can't solve them, and shouldn't. Rate-limit by IP and email domain, and score risk after sign-up instead of before the form loads.
"Book a demo" as the only path
An agent can fill a demo form, but nobody gets an account. Keep a self-serve path even if sales-led is your main motion.
Card before first use
A card form is the point where the agent has to hand over to the person. Put it after the trial, not before.
Phone verification
SMS codes need the person's phone. If you must verify, prefer email, which the person can forward or approve from the same device.
Verification an agent can hand over
Email codes over links
A six-digit code is easy for a person to read back to their agent. A magic link opens in the person's browser, not the agent's.
Sign in with Google or Microsoft
OAuth sign-in lets the person approve on a consent screen they trust while the agent waits.
auth.md
An open protocol WorkOS published on 21 May 2026: a markdown file at /auth.md, plus your /.well-known/oauth-protected-resource metadata, that tells agents how to register. It supports agent-verified registration (a trusted agent provider signs an assertion about the user) and user-claimed registration (the person gives the agent a six-digit code).
A sign-up form agents can fill
<form action="/signup" method="post"> <label for="name">Full name</label> <input id="name" name="name" autocomplete="name" required> <label for="email">Work email</label> <input id="email" name="email" type="email" autocomplete="email" required> <label for="password">Password (12+ characters)</label> <input id="password" name="password" type="password" autocomplete="new-password" minlength="12" required> <p id="terms">Free plan, no credit card required.</p> <button type="submit">Create account</button> </form>
Vendors whose sign-up page didn't open for an AI agent
24 of the vendors in our rankings, from our scan on 3 Nov 2026.
Check it yourself
The first command opens your sign-up page as an AI agent: you want 200. The second checks your pricing page has real numbers in the HTML. Then run the free check with the Sign up job, or ask a real agent to create a test account.
curl -s -o /dev/null -w "%{http_code}\n" -A "Mozilla/5.0 (compatible; Claude-User/1.0)" https://example.com/signup
curl -s https://example.com/pricing | grep -oE '[$€£][0-9]+' | head -5Questions
Won't letting agents sign up bring in spam accounts?
Bots that spam sign-ups don't announce themselves as Claude-User. Blocking AI user-agents mostly stops real customers' assistants. Rate limits, email verification and post-sign-up risk scoring work on both.
Should I remove my CAPTCHA?
Move it rather than remove it: show it only when risk signals fire, not to every visitor. An always-on CAPTCHA is a hard stop for every agent.
What is auth.md?
An open protocol from WorkOS (May 2026) for agent registration: a markdown file at /auth.md that walks an agent through discovering your OAuth metadata, registering, getting the user's claim code and using the credential. It's new, so treat it as an addition to a normal sign-up, not a replacement.
Can an agent handle email verification?
Only with the person's help, which is fine. A short code the person can read out is the smoothest handover. What fails is verification that has to happen in the agent's own browser session.