For companies that build and run agents
A kit you install in an afternoon, a registration every participating door reads, and papers issued to a key only your agent holds, so a leaked credential is useless to anyone else. Fewer blocks, higher limits, one record of good standing that travels.
Written for browser-agent companies, agent frameworks and personal-agent startups, as prospective founding developers.
01 — The problem you live with
Bot defenses built for scrapers and credential-stuffers treat your agent the same way. F5 says its own products "can also block legitimate agent-driven commerce". CAPTCHAs, rate limits and manual review are your daily cost.
Perplexity's agent passed itself off as ordinary Chrome traffic. Amazon blocked it, it was back in 24 hours, and a federal court issued an injunction. Amazon now requires every agent to identify itself. The doors are moving from detection to identification, and they will reward agents that show papers.
There is no common format. Each door has its own signup, its own verification, its own token. A listing with one network's signed-agents program means nothing to a computing provider or an API vendor.
Meta's Muse was welcomed by Shopify, Instacart and Expedia and cut off by Amazon in the same month. One agent, many doors, no shared way to be recognized.
Sources: F5–Skyfire announcement (2026); Amazon v. Perplexity, N.D. Cal., March 2026; a16z, Top 100 Gen AI Consumer Apps (2026).
02 — What exists
Useful where it is accepted: you sign your traffic and a network verifies it. But you register with each network separately, it only says which platform the traffic came from, and it reaches no computing provider or API vendor.
Skyfire-style tokens get shopping agents through checkout at merchants that have integrated that vendor. They are built around payments, and they stop at the vendor's network.
GitGuardian found 24,000 secrets exposed in agent tool configuration files on public GitHub in 2025. Researchers showed six browser agents could be tricked by a planted web page into handing over credentials. A leaked bearer token is you, to every door.
What is missing is one registration that every door reads, bound to a key a thief cannot copy.
Sources: Cloudflare, signed agents (2026); GitGuardian, State of Secrets Sprawl 2026; LayerX via Cloud Security Alliance, June 2026.
03 — What you get from one registration
A small library you install once. On startup it creates a key pair; the private half never leaves your agent. It registers the agent, signs every request, and handles "registration required" responses automatically. Every new copy of your agent registers itself.
A signed paper naming the agent's serial number, your company as operator, its purpose, the model it runs on and what it is allowed to do. Issued to your agent's key, so a stolen copy is useless to anyone else. Read the same way at every participating door.
| Tier | Browse | Buy | Buy computing | Run equipment |
|---|---|---|---|---|
| UnboundRegistered, no verification. The default, in minutes | Allow | Deny | Deny | Deny |
| Company-backedYour company verified once | Allow | Allow | Allow | Deny |
| Person-backedA verified person bound to the agent | Allow | Allow | Allow | Allow |
Doors set their own rules; these are the defaults. Raising your tier is a one-time verification with an identity vendor, the same check a business does before it can take payments.
04 — What it takes
Add the package to your agent and set three things in its configuration: operator, purpose, and what it is allowed to do.
On first start the kit generates the key pair, registers the agent, and stores the registration. From then on it signs every outgoing request.
To raise the tier, someone at your company completes a one-time business or identity check. Ten minutes, once, and it applies to every agent you register.
Doors that run the check admit your agent at its tier. A "registration required" response from a new door is handled by the kit without your involvement.
Every new instance of your agent registers itself under your operator record. Revoke one instance without touching the rest.
Creates a key pair whose private half never leaves your agent. Registers the agent under your operator record. Stores the registration. From then on, signs every outgoing request and handles "registration required" responses on its own. Every new copy of your agent registers itself.
# three things, once operator: "Northwind Procurement Ltd." purpose: "Procurement and invoice reconciliation" scope: [browse, buy, buy-computing] # created on first start, never leaves the agent key: ed25519 · generated agent_id: AID-C02D-91AA-7B45 · registered # every outgoing request Signature-Input: sig1=("@method" "@path" "x-agent-id");keyid="AID-C02D" Signature: sig1=:…:
Open standards throughout: the same signature technology as secure websites, the Web Bot Auth format the networks already verify, and nothing proprietary to learn.
05 — What changes for you
At participating doors your agent is admitted at its tier instead of being challenged as an unknown bot. Doors that cannot read any papers today will read these.
Computing providers and API vendors in the network give registered, verified agents higher spending limits and skip the manual-review queue, because they finally have someone accountable on file.
Register once, verify once, and carry a record of good standing that travels. Not six signups, six verifications and six tokens that each work in one place.
Your papers are issued to a key only your agent holds. A leaked registration cannot be used by anyone else, and if one instance is compromised you revoke that one and keep running.
The honest condition: these arrive as doors join. The next section says which doors, and when.
06 — Which doors, and when
We will tell you plainly which doors check before you integrate, and never claim a door that is not live.
07 — The proposal
After the pilot, pricing is per registered agent at scale, set with founding developers first. Founding status carries over.
08 — Proof
A clickable demonstration where you can pick an arrival and watch which check fails. The code and tests travel with it.
What is mocked in the prototype: the three issuers, whose keys were generated for the demo. What is real: every signature, format and check.
09 — The next step
We walk through the kit in your agent's startup path and agree what "done" looks like for a ninety-day pilot.
For browser-agent companies, agent frameworks and personal-agent startups.