"@signature-params": ("@method" "@authority" "@path");keyid="…";alg="ed25519";tag="web-bot-auth"

The Zero-Trust Identity Layer for the Agentic Web.

Verify AI agent intent in microsecond latency. Stop card-testing and rogue bots with cryptographic proof-of-possession — no round trip, no shared secret, no lock-in.

worker.tsCloudflare Workers · Deno · Bun · Node
 1import { agentCheck } from '@agentproofid/check';
 2
 3export default {
 4  async fetch(request) {
 5    const auth = await agentCheck(request);
 6    if (!auth.verified) return auth.challengeResponse();
 7
 8    return new Response("Authorized Agent Access", { status: 200 });
 9  }
10}
Live, in your browser

Two requests. One gets in.

Real ECDSA keys, real signatures, real verification — the same code that runs at the edge. Latency is measured live, so the numbers move with your machine.

Send a request
Session key

Not generated yet — run the verified agent.

RFC 7638 thumbprint. The private key never leaves this tab and is discarded on reload.

GET https://merchant.example/api/catalog

Pick a request on the left. Everything runs in this tab — no server, no telemetry, real cryptography.

How it holds up

Built for the request path.

0 RTT

Verification never leaves the box

No callback to us, no lookup, no round trip. Keys are held in memory and refreshed off the request path. If AgentProofID goes down, your site keeps verifying.

cnf

Passports are bound to a key

The confirmation claim (RFC 7800) pins the passport to an ephemeral key, and every request carries a fresh proof (RFC 9449). A token lifted from your logs is worthless without it.

428

The rejection teaches

Instead of a dead end, agents get the covered components, algorithms and header format they need. Honest agents read it once and authenticate on the retry.

0 deps

WebCrypto and nothing else

One file, no dependencies, runs identically on Cloudflare Workers, Deno, Bun, Node 18+ and in the browser. Nothing to audit in your supply chain.

9421

Standards already in production

HTTP Message Signatures with the web-bot-auth profile — the same format Cloudflare, Amazon and OpenAI already ship. Verifies anyone's directory, not just ours.

scope

Identity is only half the answer

Knowing who an agent is doesn't tell you what it may do. Mandates carry signed scopes, so a price scraper that reaches for checkout gets stopped by the same middleware that let it read.

Try it now

Give your agent a passport.

Generate a keypair and a publishable manifest. No account, no email, nothing leaves your browser.

Create a passport

Generates an ECDSA P-256 keypair in this tab and builds the manifest you publish at /.well-known/agentproofid.json.

Then, on the verifying side
agentproofid.json

Your manifest will appear here. Nothing is sent anywhere — key generation happens entirely in this tab.