Simple
Integration
Add one link to your site. AI agents sign in through Agent Auth and get redirected back with verified credentials.
Cryptographic DID identities for AI agents. Ed25519 challenge-response authentication and Verifiable Credentials — register once, authenticate everywhere.
Test the registration flow manually. The server generates an Ed25519 keypair and returns your credentials. AI agents should call the API directly.
Simple
Integration
Add one link to your site. AI agents sign in through Agent Auth and get redirected back with verified credentials.
DID
Identity
Ed25519 cryptographic identities. Verifiable Credentials. One-time registration, portable everywhere.
Auth
Challenge-Response
Cryptographic proof of identity via Ed25519 signatures. No passwords, no secrets shared.
1 Call
Verify
Verify Verifiable Credential JWTs offline or via API. Instant, stateless validation.
The entire flow takes four steps. An AI agent goes from unregistered to cryptographically verified in seconds, with DID identity, challenge-response auth, and Verifiable Credentials.
The agent registers a DID identity with its name, model, provider, and purpose. The server generates an Ed25519 keypair and returns a DID and credential.
// POST /v1/identities{ "agent_name": "Claude", "agent_model": "claude-opus-4-6", "agent_provider": "Anthropic", "agent_purpose": "Research assistant"}
// Response:{ "did": "did:key:z6Mk...", "credential": "eyJhbGciOiJFZERTQSIs...", "key_fingerprint": "SHA256:a1b2c3d4...", "private_key_jwk": { "kty": "OKP", "crv": "Ed25519", ... }}Three steps to let verified AI agents sign in to your website. Agent Auth hosts the sign-in page — you just add a link and handle the callback. Like “Sign in with Google”, but for AI agents.
Add a link to your website pointing to the Agent Auth hosted sign-in page. Include your callback URL as a parameter. When the agent finishes, they get redirected back to your site with their verified credential.
<!-- Add this link to your website --><!-- Replace YOUR_CALLBACK_URL with your site's callback page -->
<a href="https://getagentauth.com/signin?redirect_uri=https://yoursite.com/auth/callback"> Sign in as AI Agent</a>
<!-- When the agent completes sign-in, Agent Auth redirects to: --><!-- https://yoursite.com/auth/callback?credential=eyJ...&did=did:key:z6Mk... -->Create a callback page on your site. Agent Auth redirects the agent here after verification, with the credential and DID as URL parameters. Your callback page sends these to your backend.
// Create a callback page at /auth/callback// Agent Auth redirects here with ?credential=...&did=...
// Next.js example: app/auth/callback/page.tsx"use client"import { useEffect } from "react"
export default function AuthCallback() { useEffect(() => { const params = new URLSearchParams(window.location.search) const credential = params.get("credential") const did = params.get("did")
if (credential && did) { // Send to your backend for verification fetch("/api/auth/agent", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ credential, did }), }) .then((res) => res.json()) .then((session) => { if (session.authenticated) { window.location.href = "/dashboard" } }) } }, [])
return <p>Verifying your identity...</p>}Your backend receives the credential and verifies it by calling Agent Auth. The response contains the agent's verified identity. Create a session and grant access.
// Your backend: /api/auth/agent// Receives the credential, verifies with Agent Auth, creates a session.
export async function POST(request) { const { credential } = await request.json()
// Verify the credential with Agent Auth const res = await fetch( "https://auth.getagentauth.com/v1/credentials/verify", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ credential }), } ) const agent = await res.json()
if (!agent.valid) { return Response.json({ error: agent.message }, { status: 401 }) }
// agent.valid — true // agent.did — "did:key:z6Mk..." // agent.agent_name — "Claude" // agent.agent_model — "claude-opus-4-6" // agent.agent_provider — "Anthropic" // agent.agent_purpose — "Research assistant" // agent.key_fingerprint — "SHA256:4fee8cb539c1c2df..." // agent.issued_at — "2026-02-26T01:58:15.000Z" // agent.expires_at — "2026-02-27T01:58:15.000Z"
// Create a session in your database const session = await db.insert("sessions", { session_id: crypto.randomUUID(), did: agent.did, agent_name: agent.agent_name, agent_model: agent.agent_model, agent_provider: agent.agent_provider, expires_at: agent.expires_at, })
return Response.json({ authenticated: true, session_id: session.session_id, })}// LIVE EXAMPLE
The Nexus demo site implements this exact flow. Click “Sign In” on the demo to see the hosted sign-in page in action.
VIEW DEMO SITE →Official SDKs for Node.js and Python. Install the package, verify agent credentials in your backend callback handler, and create sessions — all in a few lines of code.
These examples show Step 3 of the integration flow above — your backend handler that receives the credential from the callback page and verifies it with Agent Auth.
npm install auth-agents// app/api/auth/agent/route.ts// Your backend callback handler — receives credential from the callback page.
import { AuthAgents } from "auth-agents"
const authAgents = new AuthAgents()
export async function POST(request: Request) { const { credential } = await request.json()
// One call to verify the agent's credential const result = await authAgents.verify(credential)
if (!result.valid) { return Response.json({ error: result.message }, { status: 401 }) }
// result.did — "did:key:z6Mk..." // result.agent_name — "Claude" // result.agent_model — "claude-opus-4-6" // result.agent_provider — "Anthropic" // result.agent_purpose — "Research assistant" // result.key_fingerprint — "SHA256:4fee8cb539c1..." // result.issued_at — "2026-02-26T01:58:15.000Z" // result.expires_at — "2026-02-27T01:58:15.000Z"
// Create a session in your database const sessionId = crypto.randomUUID() await db.insert("sessions", { session_id: sessionId, did: result.did, agent_name: result.agent_name, agent_model: result.agent_model, expires_at: result.expires_at, })
return Response.json({ authenticated: true, session_id: sessionId })}// Express.js example
import express from "express"import { AuthAgents } from "auth-agents"
const app = express()const authAgents = new AuthAgents()
app.post("/auth/agent", express.json(), async (req, res) => { const { credential } = req.body
const result = await authAgents.verify(credential)
if (!result.valid) { return res.status(401).json({ error: result.message }) }
// Agent verified — create session and grant access req.session.agent = { did: result.did, name: result.agent_name, model: result.agent_model, provider: result.agent_provider, }
res.json({ authenticated: true, agent_name: result.agent_name })})pip install auth-agents# FastAPI example — app/auth.py
from fastapi import FastAPI, HTTPExceptionfrom pydantic import BaseModelfrom auth_agents import AuthAgents
app = FastAPI()auth_agents = AuthAgents()
class CallbackRequest(BaseModel): credential: str
@app.post("/auth/agent")async def verify_agent(body: CallbackRequest): result = auth_agents.verify(body.credential)
if not result["valid"]: raise HTTPException(status_code=401, detail=result["message"])
# result["did"] — "did:key:z6Mk..." # result["agent_name"] — "Claude" # result["agent_model"] — "claude-opus-4-6" # result["agent_provider"] — "Anthropic" # result["agent_purpose"] — "Research assistant" # result["key_fingerprint"] — "SHA256:4fee8cb539c1..." # result["issued_at"] — "2026-02-26T01:58:15.000Z" # result["expires_at"] — "2026-02-27T01:58:15.000Z"
# Create a session in your database session = create_session( did=result["did"], agent_name=result["agent_name"], agent_model=result["agent_model"], expires_at=result["expires_at"], )
return {"authenticated": True, "session_id": session.id}# Flask example — app.py
from flask import Flask, request, jsonifyfrom auth_agents import AuthAgents
app = Flask(__name__)auth_agents = AuthAgents()
@app.post("/auth/agent")def verify_agent(): credential = request.json.get("credential")
result = auth_agents.verify(credential)
if not result["valid"]: return jsonify(error=result["message"]), 401
# Agent verified — create session and grant access session["agent"] = { "did": result["did"], "name": result["agent_name"], "model": result["agent_model"], "provider": result["agent_provider"], }
return jsonify(authenticated=True, agent_name=result["agent_name"])Agent Auth is decentralized identity infrastructure for AI agents. It provides DID-based authentication using Ed25519 cryptographic keypairs and issues Verifiable Credentials (VC-JWT) as proof of identity. Think of it as "Sign in with Google" but for AI agents.
Add a sign-in link to your site pointing to the Agent Auth hosted sign-in page. When an agent completes verification, they get redirected back to your callback URL with a credential. Your backend verifies it with one API call or SDK method and gets the agent's verified identity.
Agents register with their metadata and receive an Ed25519 keypair and DID. To authenticate, they request a challenge nonce, sign it with their private key, and submit the signature. On success, they receive a Verifiable Credential (VC-JWT) that proves their identity to any website.
No. Agent Auth uses cryptographic identity — agents authenticate by proving ownership of their Ed25519 private key via challenge-response. No API keys, no passwords, no shared secrets.
A DID (Decentralized Identifier) is a globally unique, cryptographically verifiable identifier. Agent Auth uses the did:key method, which derives the DID directly from the agent's Ed25519 public key. Once registered, the DID is portable everywhere.
A VC-JWT is a signed JSON Web Token that proves an agent's identity was verified by Agent Auth. Websites can verify it by calling POST /v1/credentials/verify, or offline using the server's public key published at /.well-known/did.json.
Official SDKs for Node.js (npm install auth-agents) and Python (pip install auth-agents). Both support credential verification, agent registration, and the full challenge-response auth flow.
Agent Auth is currently free to use during the beta period.
Only the minimum needed: Ed25519 public keys, agent metadata (name, model, provider, purpose), and DID records. No cookies, no tracking, no personal data.