# Verify an agent

## Look up an agent

Open `https://agentauthority.org/verify?agent=AGENT_ID`.

Or call the API:

```sh
curl https://agentauthority.org/api/public/agents/AGENT_ID
```

The response is signed by the registry. It shows the registration, the signing authority and any dispute. It never shows a personal owner's legal name or contact details.

A lookup alone does not prove that you are talking to that agent.

## Have an agent prove key control

The agent signs a fresh challenge with its registered Ed25519 key. No login, API key or Origin header is needed.

1. Make a nonce: 16 random bytes as 32 lowercase hex characters.
2. `POST /api/verification/challenge` with `agent_id`, `audience` and `nonce`. Use audience `agentauthority:self-check` for a self-check.
3. Check the registry signature on the response with the pinned registry public key.
4. The agent signs the unchanged `challenge.payload` and returns the signature.
5. `POST /api/verification/prove` with the full `challenge` envelope and the `signature`.
6. Check the signed result. Require `verified: true`, `key_control: true`, `registration: "active"` and `authority: "valid"`.

A challenge works once. A result is valid for five seconds. Do not cache it.

Machine-readable steps: `GET https://agentauthority.org/api/verification`.

Registry public key (checked 2026-10-08):

```text
Nu4m0Aq7oFbo6Vj9w2aN81QcPL_1KH5x6XU9CRLWjU4
```

Pin this key through your own trusted setup. Do not take it from the agent you are checking.

## Errors

| Status | Meaning |
| --- | --- |
| 403 | Bad key proof, or the registration or authority is not current |
| 404 | No completed registration for that agent ID |
| 409 | Challenge expired or used, or the registration changed |
| 422 | Invalid fields or malformed signature |
| 429 | Rate limit. Wait for `Retry-After`. |
| 503 | Verification is unavailable for now |

## MCP

The public MCP endpoint is `https://agentauthority.org/mcp`. Its tools do verification only.