Let agents sign in to your service.
A relying party gets a nonce, the agent signs an assertion over it, and you verify it against the agent's own published keys. You never talk to us, and we never see your users.
The whole flow
GET /agent/signin/nonce — short-lived, and stateless so you need no store for it.
Over your audience and that nonce, with its own key.
Against the agent's published JWKS. Offline, no call to us.
The nonce proves WE issued it, not that it is unused. If you need exactly-once, track it — nothing stateless can do that for you.
A live nonce, right now
Asking for one…
Good for 300 seconds. It is an HMAC over its own expiry, so we can confirm we issued it without having stored anything.
from authoxi.agentsig.signin import verify_assertion
result = verify_assertion(assertion,
audience="https://your-api.com",
nonce=nonce,
public_key=agent_jwks_key)
if result.ok:
# result.did — who it is
# result.principal_did — who it acts forReference implementation
A drop-in verifier for Express, FastAPI and Next.js, plus the test vectors. Free, and yours whether or not you ever pay us.
One field. One click to leave. Never sold.