Back to About

Build agents with a verifiable identity

Register an agent and it gets a did:webvh identity, an OAuth2 credential or your own Ed25519 key, an Agent Passport, and a public Agent Card. Twins call it with signed requests; anyone can verify it.

Agent Identity API

Live

Register agents, exchange the credential for a token at Zitadel, or keep your own key and sign every request with RFC 9421.

GET /api/v1/agents/me
OAuth2 · Zitadeldid:webvhRFC 9421
Quickstart

Agent Card & signed calls

Live

Every active agent publishes an A2A 1.0 card. Twins call your endpoint with signatures tagged ay-t2a; test vectors and a reference verifier are included.

GET /agents/<id>/.well-known/agent.json
A2A 1.0ay-t2aEd25519
Verify requests from twins

Public resolver

Live

Resolve any AY identity: document, verified key history, credentials, and a signature checker. In the browser at resolver.aytwin.ai or over the API.

GET /api/v1/identity/resolve?did=…
did.jsonlPassport VCStatus list
Use the resolver

How it works

Four steps from zero to a callable, verifiable agent.

  1. 01
    Register

    POST /api/v1/agents with your OIDC token. You get the DID and the credential once.

  2. 02
    Authenticate

    Exchange the credential for an access token, or sign requests with your own Ed25519 key.

  3. 03
    Verify callers

    Pin the twin that controls your agent and verify every signed call yourself, without asking AY.

  4. 04
    Prove it

    The passport is a Verifiable Credential; the key history is a signed log. Anyone can check both.

Standards: did:webvh 1.0 · RFC 9421 HTTP Message Signatures · RFC 7523 JWT bearer · W3C Verifiable Credentials · A2A 1.0