AAuth Agent Provider · demo

Give every AI agent an identity it can prove.

apd issues short-lived, signed identities to your agents — no API keys, no shared secrets. Self-hostable, multi-arch, and verifiable by anyone against a published key set.

Install Read the docs
Multi-arch image + Helm Ed25519, proof-of-possession ~11 MB, non-root

Free and open source. Running it in production? Commercial support is available.

Hosted sandbox

Try it without running anything.

Build and test AAuth agents against a live provider — no local setup, no sign-up, ephemeral by design.

bash
# the live provider — open enrollment, no credential needed
$ curl -s https://sandbox.agentprovider.dev/.well-known/aauth-agent.json

# the keys every verifier checks your tokens against
$ curl -s https://sandbox.agentprovider.dev/.well-known/jwks.json
Use the sandbox Or run your own

Development only. Sandbox tokens have no production value. Agents are wiped daily at 03:00 UTC and on every redeploy — treat “agent not found” as normal and re-enroll. No SLA, no accounts, no data retention.

Quickstart

Run it in a minute.

Prebuilt images and an OCI Helm chart ship on every release. Pick your path.

Create the signing key once, then serve. The image is distroless and non-root.

bash
# 1 · generate the AP signing key (once)
$ docker run --rm -v "$PWD:/data" \
    ghcr.io/agentprovider/apd:latest \
    keygen --keys /data/apd-keys.json

# 2 · run the provider
$ docker run -p 8420:8420 -v "$PWD:/data:ro" \
    ghcr.io/agentprovider/apd:latest \
    serve --config /data/apd.json

All replicas share the same keys; create the secret, then install the chart from GHCR.

bash
# create the shared signing-key secret
$ kubectl create secret generic apd-keys \
    --from-file=apd-keys.json

# install the OCI chart
$ helm install apd \
    oci://ghcr.io/agentprovider/charts/apd \
    --set issuer=https://ap.example.com \
    --set keys.existingSecret=apd-keys

Build the single binary yourself — the workspace is dependency-light Rust.

bash
$ git clone https://github.com/agentprovider/source-code
$ cd source-code && cargo build --release
$ ./target/release/apd keygen --keys apd-keys.json
$ ./target/release/apd serve --config apd.json

Demo mode. AAuth is an IETF Internet-Draft, not yet a released standard. apd tracks the drafts and announces this at runtime; pin a version and expect wire changes as the spec matures.

Why apd

API keys, replaced.

The provider is the small, load-bearing piece: it mints identities and publishes the keys to verify them. Everything else is additive.

Secret-free enrollment

Agents enroll with your Kubernetes, CI, corporate CA, or SPIFFE workload identity — a signed assertion, never a copied secret. OIDC, operator-minted, X.509, or SPIFFE JWT-SVID.

Proof-of-possession

Every token binds an Ed25519 key via cnf. Each request is signed (RFC 9421); a stolen token is useless without the private key.

Ships to production

Multi-arch (amd64 + arm64) image and an OCI Helm chart on every release, plus a rolling edge. ~11 MB distroless, non-root.

Stateless verification

Relying parties verify against your published JWKS — never a call back to apd. Scale horizontally with Redis-shared state and matching keys.

Events inbox

Deliver async events to agents that have no public URL — the provider is their inbox, with cryptographic delivery and no shared secrets.

Audit trail

Structured JSON for every enrollment decision, denial, issuance, and revocation — to stderr and an optional file. The review trail for automated issuance.

Assurance tiers

Every token carries an assurance claim — none → high — derived from how the agent enrolled. Person Servers and resources gate on it, proportional to trust.

OpenTelemetry

Metrics and traces over OTLP to any Collector — enrollment, issuance, and verify-failure counters, request latency, per-request spans. Off by default, one flag to enable.

The flow

Enroll once. Sign everything.

Three steps, then the agent operates on its own. The human sets it up and consents to new authority — never a secret in flight.

step 1

Enroll

The agent generates a key locally and proves it holds it. apd hands back a stable identity: aauth:local@domain.

step 2

Issue

apd returns a short-lived token binding that key, refreshed automatically. No refresh secrets, no long-lived credentials.

step 3

Sign & verify

The agent signs every request; any resource verifies it against apd's published keys — no callback, no shared secret.

The other roles

apd is one of three.

AAuth splits the job. apd says what an agent is; a Person Server says whose it is and what it may do; a resource verifies both. Each is a separate service, run by a different party, and none registers with the others.

the person's side

psd — Person Server

Consent, missions, and identity claims. Issues person tokens and auth tokens so a resource can know who an agent acts for. Self-hostable, same shape as apd.

personserver.dev the agent's side

agentd — agent runtime

A minimal runtime that enrolls with an Agent Provider, holds its own Ed25519 key, and signs every MCP request. Point it at apd with one flag.

agentd.dev the resource's side

mcpg — MCP gateway

Verifies the per-request agent signature in front of your MCP server and maps the agent principal into its identity context. No verification code of your own.

mcpg.dev
Documentation

Build with it.

Hands-on guides for both sides of the exchange, plus operations and the protocol notes behind the code.

no setup required

Hosted sandbox

A live provider at sandbox.agentprovider.dev — open enrollment, 5-minute tokens, ephemeral by design.

Open guide for agent developers

Build an agent

Keys, enroll, get a token, sign requests, the resource loop, and the Person Server flow.

Open guide for resource / MCP servers

Protect an MCP server

Verify agent identity at the edge, map scopes to tools, and the four-rung adoption ladder.

Open guide enterprise / dynamic fleets

Federated enrollment

Recipes for EKS/GKE, on-prem Kubernetes, operators, SPIFFE, corporate PKI, and CI OIDC.

Open guide operate

Deploy

TLS, single- and multi-instance topologies, key rotation, the image, the Helm chart, CI/CD.

Read operate

Configuration

Every field, environment overrides, and the storage backends — memory, file, and Redis.

Read the protocol

AAuth, distilled

Parties, tokens, the four access modes, HTTP signatures, and events — the notes behind the code.

Read