Book a 15-minute call

Open standard, MIT, v0.1

Agent Passport, an open identity standard for AI agents.

A verifiable, business-issued identity and authority document for AI agents that talk to other AI agents across organisational boundaries. One signed JSON file at /.well-known/agent-passport.json. Ed25519 over DNS. Authored by Cubitrek on April 28, 2026, published MIT for industry use.

Spec on GitHubRead the announcementAdopters

What it is

A signed JSON file with seven required fields.

An organisation publishes one document at the well-known URL on its own domain. The document declares who issued the agent, what the agent is allowed to do, what it can spend, who picks up when it crashes, and where the audit log lives. Counterparty agents verify it with one schema check plus one Ed25519 verify.

  • version

    Spec version. v0.1 today.

  • issuer

    Legal name, display name, logo, signing-key DNS hostname, contact.

  • agent

    Stable id, display name, purpose, model, machine-callable endpoints (MCP, A2A, REST).

  • authority

    Scope list, hard spend ceiling, human-in-loop threshold, escalation SLA, decisionAudit URL.

  • issuedAt + expiresAt

    Validity window. 90-day expiry recommended.

  • signature

    Ed25519 over canonical JSON. keyId binds to a DNS TXT record at _agent-passport.{domain}.

Prove who is calling

A passport says what a company authorised, not who is knocking.

The file is public, so anyone can quote it. The issuer closes that gap by listing its agent's request-signing keys inside the passport it already signs. The agent signs every request it sends (HTTP Message Signatures, RFC 9421) and the receiver checks that signature against those keys. Four checks, in order.

  • 1. Passport

    Fetch and verify it: schema, the signing key inside the issuer's own DNS zone, the Ed25519 signature, the validity window, the revocation list. Now you know what the company authorised.

  • 2. Caller

    Check the request signature against the keys the passport publishes. It covers the method, host, path, query and body, expires in a minute, and can be accepted once. Now you know who is calling.

  • 3. Authority

    Decide the action against the passport: allow, escalate to the issuer's human, or deny, each with a reason code you can log.

  • 4. Execution

    Check again immediately before the side effect. The decision is bound to the exact tool, target and arguments, so a destination swapped after approval is refused.

Resources

Spec, schema, verifier, and worked examples.

Everything you need to issue your own passport this week.

  • Spec (v0.1)

    Canonical JSON form, DNS trust anchor, verification flow, threat model.

    spec/agent-passport-v0.1.md

  • JSON Schema (2020-12)

    Strict validation. Plug into Ajv or any 2020-12 validator.

    schemas/agent-passport.schema.json

  • Reference verifier

    Verify a passport, decide allow, escalate or deny, bind a caller, issue and renew passports, health-check a live one, or run the MCP server. TypeScript, ESM, Node 20+, Cloudflare Workers, the browser. Source in the spec repo, not on npm yet.

    packages/verifier

  • Threat model

    Issuer impersonation, key compromise, authority escalation, stale credentials, replay. Out of scope, on purpose.

    spec/threat-model.md

  • Cubitrek's own passport

    Worked example. The live passport for the hire-router agent, signed with the kid=cubitrek-2026-q3 key and valid to 14 December 2026.

    https://cubitrek.com/.well-known/agent-passport.json

  • Caller binding

    Request-signing keys published in the passport, RFC 9421 signatures, and the order a receiver checks them in. Implemented in the reference tooling.

    spec/proposals/caller-binding.md

  • Decision receipts

    Binding one decision to the exact action, and carrying it between two companies. Proposal for v0.2.

    spec/proposals/execution-binding.md

  • Adopters list

    Businesses publishing a valid passport. Send a PR to add yours, the maintainers fetch and verify before listing.

    https://cubitrek.com/agent-passport/adopters

Issue your own

Five steps. One engineer afternoon.

  1. Generate an Ed25519 keypair.

    Use Node crypto.generateKeyPairSync, OpenSSL, or any standard library. Store the private key offline. Export the raw 32-byte public key as base64url. The agent-passport CLI in the repo does this step, the file and the signature for you.

  2. Publish a DNS TXT record.

    At _agent-passport.{your-domain}, add: v=ap1; kid=<id>; alg=ed25519; pk=<base64url public key>. Same operational pattern as DKIM.

  3. Author your passport JSON.

    Copy one of the example files in the repo, fill in your issuer, agent, authority, and compliance fields, set issuedAt + a 90-day expiresAt.

  4. Sign and serve.

    Canonicalize with signature.value set to the empty string, Ed25519-sign the bytes, write the base64url signature back into signature.value, serve the file at /.well-known/agent-passport.json.

  5. Verify and list.

    Run agent-passport doctor against your own domain: it checks delivery, caching, DNSSEC, the signature, expiry runway, the revocation list and every linked URL, and prints a fix for each problem. Then send a PR to adopters.md and we will add a row.