--- title: "PLG for the Agent Era, Part 3: Onboarding Agents" description: "What it actually takes to let an agent sign up, try your product, and buy it. Without a human touching a browser." date: 2026-06-08 author: Kat Laszlo canonical: https://tansohq.com/blog/onboarding-agents --- > **Note:** This post describes the original hosted Tanso. Tanso is now open source and self-hostable under AGPL-3.0 โ€” [github.com/tansohq/tanso-oss](https://github.com/tansohq/tanso-oss). Some details below may not match the current project. This post describes agent-first onboarding as we built it for Tanso Observe, our hosted product (since retired). The pattern outlived the product: the open-source Tanso ships an MCP server with the same design stance โ€” see the [MCP docs](https://tanso.mintlify.app/mcp). # PLG for the Agent Era, Part 3: Onboarding Agents By [Kat Laszlo](https://www.linkedin.com/in/katrinalaszlo/) ยท June 8, 2026 What it actually takes to let an agent sign up, try your product, and buy it. Without a human touching a browser. --- ## What Happens When an Agent Tries to Buy [Last week](/blog/is-your-site-ready-for-ai) we asked whether an agent can understand your website. This week: once it does, once it lands on your site and decides your product is worth trying, can it actually sign up? For most products, no. The product works fine. The front door doesn't. Almost every SaaS flow hides a browser somewhere. Email verification loops, CAPTCHA, API keys you can only generate from a dashboard, browser-only checkout, settings buried behind a UI. Humans barely notice. Agents hit a wall at every step. The reflex is to say self-serve is dead, that PLG had its moment and agents killed it. Some people are already calling the replacement "Agent-Led Growth," a model where agents autonomously run the revenue workflows humans used to click through. We don't buy it. Self-serve relocated. Clear pricing, low friction, fast time-to-value. Every decision that made PLG work still matters. It just has to be made at the API layer, not only the visual one. An agent evaluating your product asks the same questions a developer on a free trial asks. Can I sign up without talking to anyone? Can I see what this costs? Can I try it before I commit? Can I scale up and down? The only difference is that every answer now has to be API-accessible, not just well-designed in a UI. This isn't hypothetical. [Ramp shipped Agent Cards](https://ramp.com/blog/introducing-agent-cards). [Stripe shipped the Agent Toolkit](https://docs.stripe.com/agentic). [Vercel lets agents buy credits](https://vercel.com/blog/vercel-for-ai-agents) without opening a browser. Your next customer might not be a person. ## The Agent Onboarding Funnel When a human signs up for your product, they move through a funnel. Create an account, prove they're real, pick a plan, start using it, manage it over time. Agents move through the exact same funnel. The problem is that most products put a browser wall at every stage. Every stage has a human version (signup form, login page, checkout, settings panel) and an API version. Most products built the first. Almost nobody built the second. ### Stage 1: Onboarding Can an agent go from zero to "has an account with API access" without opening a browser? #### What Blocks Agents CAPTCHA / reCAPTCHA. Email verification loops. SMS OTP. Manual approval queues ("we'll review your application"). Multi-step browser wizards. Device fingerprinting that flags headless browsers. #### What Works `POST /v1/accounts` returns account ID + API key in one response. No email loop. No browser. [Stripe](https://docs.stripe.com/api/accounts/create) does this. [Cloudflare](https://developers.cloudflare.com/api/) does this. One call, you're in. Developer tools are converging on **deploy-first, claim-later**. Netlify lets you push a site live anonymously and claim the account after. Prisma provisions a database before you've verified an email. Agent provisions immediately, human claims ownership later. Security still matters. The separation is between "start using the product" and "prove you're a human." The tradeoffs are real. Removing CAPTCHA has implications. But alternatives exist: Web Bot Auth (the RFC 9421 profile, live at Cloudflare, AWS WAF, and Vercel), cryptographic agent identity, IP reputation scoring. You don't have to choose between blocking agents and blocking bots. ### Stage 2: Authentication Can an agent prove its identity without a human performing a ceremony? #### Auth Methods, Ranked for Agents Best**API keys with scopes.** Simple, revocable, granular. The standard. Best**OAuth Client Credentials.** Machine-to-machine. No browser redirect. The grown-up option. Okay**Service accounts with key pairs.** Google Cloud model. Works, but heavier setup. Friction**OAuth Authorization Code + PKCE.** Requires browser redirect. Blocks agents unless a human pre-authorizes. Hostile**Magic links / email OTP.** Requires inbox access. Agents don't have inboxes. Impossible**CAPTCHA.** Designed to block automation. Replace with Web Bot Auth or proof-of-work. Most products already support API keys. The gap is that key generation still requires a dashboard visit. If a human has to log in, click "API Keys," and copy a token, the agent can't self-serve. The fix: A `POST /v1/api-keys` endpoint that generates scoped keys programmatically. ### Stage 3: Purchasing Can an agent see what it costs, pick a plan, and pay? Most B2B pricing is hidden behind "Contact Sales." Agents don't contact sales. And even when pricing is published, it's in a format agents can't parse. Comparison tables in HTML, feature matrices in PDFs, "starting at $X" with an asterisk. #### What Blocks Agents "Contact Sales" gates. Browser-only Stripe Checkout. Pricing pages that only render in HTML tables. No plan catalog API. Payment requires human-interactive flow. #### What Works `GET /v1/plans` returns a machine-readable catalog. `POST /v1/subscriptions` creates one. A human saves a payment method once (Stripe Setup Intent), and the agent reuses it. Publish `pricing.json` at your domain root for discovery. The pattern is: **human sets guardrails, agent executes within them.** A human authorizes a payment method and sets a spending ceiling. The agent evaluates plans, selects one, and purchases, all inside the pre-authorized boundary. Ramp's Agent Cards work exactly like this. Tokenized cards tied to specific transactions, with spending limits and approval workflows. ### Stage 4: Account Management Once the agent is in, can it manage itself? Upgrade plans. Change configuration. Monitor usage. Cancel if needed. Most products lock all of this behind a settings page. The agent equivalent is simple. Every settings page needs an API endpoint behind it. `GET /v1/usage` Current-period consumption, remaining quota, burn rate. `PATCH /v1/subscription` Upgrade, downgrade, change billing cycle. `PUT /v1/config` Update product configuration. `DELETE /v1/subscription` Cancel (with confirmation semantics). Rate limit headers on every response: `x-ratelimit-remaining`, `x-ratelimit-reset` Threshold webhooks so agents can self-throttle before they hit limits. --- ## The Maturity Ladder Not every product needs to be agent-first tomorrow. But it helps to know where you stand. Access and quality are separate dimensions. A product can be Level 3 (full API access) but developer-hostile. Vague errors, no test mode, broken pagination. Or Level 1 (minimal API) but beautifully designed. Structured errors, idempotency, OpenAPI spec. Access gets agents in the door. Quality determines whether they stay. --- ## Two Readers, Two Interfaces Your product now has two kinds of users. Agents interact through APIs and MCP tools. Humans interact through dashboards, Slack bots, and in-app copilots ([CopilotKit](https://www.copilotkit.ai/), Vercel AI SDK, and others). Same capabilities, same permissions, same data. Different surfaces. A human asks "what's my usage?" in the dashboard. An agent hits `GET /v1/usage`. A team lead types `/tanso usage acme` in Slack. The API layer you build for agents is the foundation. The human surfaces are views on top of it. [Read the docs at tanso.mintlify.app โ†’](/docs) --- ## agent-serve: Audit Your Own Product We kept seeing the same gaps across products, so we built [agent-serve](https://github.com/katrinalaszlo/agent-serve). It's a set of Claude Code skills that walk each stage of the funnel and tell you what's blocking agents. Onboarding, auth, purchasing, usage, management, dev quality. Point it at a URL or run it against your codebase. Each area gets the same report: What exists today, what blocks agents, what to build. The skill is deliberately specific. "Add an API" is useless advice. "`POST /v1/accounts` with email and password, return the API key in the response body, no email verification required, reference Stripe's account creation flow, roughly 2 days of effort" is useful advice. That's the difference between a framework and a build plan. Works with Claude Code, Cursor, Codex, Cline, Gemini CLI, and 60+ other coding agents. We ran it on [Tanso](https://github.com/tansohq/tanso-oss). The audit made the product boundary explicit: Tanso is self-hosted, and tansohq.com does not expose a hosted billing API. Each deployed Tanso instance exposes the REST API and an optional MCP server under the operator's own authentication and infrastructure. The gap was invisible until we looked. --- ## The Practical Pipeline You don't have to build all of this from scratch. There's a path that connects tools that already exist: At the end of that pipeline, your product is accessible to humans, developers, and agents. --- ## If You're Starting From Zero Most products aren't at Level 0. They have some API. But if yours is fully dashboard-only, here's the practical sequence: Most agent interactions are reads. Checking status, fetching data, monitoring usage. Expose reads first. They're safe, useful, and they prove the pattern before you tackle writes. --- ### The Takeaway Self-serve growth tactics, design discipline, onboarding strategy. None of it went away. The decisions that made PLG work still need to be made. Clear pricing, low friction, fast time-to-value, progressive trust. The difference is that those decisions now have to be expressed programmatically, as API endpoints, machine-readable pricing, structured errors, and scoped credentials. Not just as well-designed UI flows. The growth playbook isn't dead. It has a new reader. *[Kat Laszlo](https://www.linkedin.com/in/katrinalaszlo/) is co-founder of Tanso. This post also appears on [katrinalaszlo.com](https://katrinalaszlo.com/blog/onboarding-agents).* ### Want to price with confidence? Book a quick call and we'll walk you through it. More for agents: https://tansohq.com/llms.txt