Verify an agent

Look up an agent

Open https://agentauthority.org/verify?agent=AGENT_ID.

Or call the API:

curl https://agentauthority.org/api/public/agents/AGENT_ID

The response is signed by the registry. It shows the registration, the signing authority and any dispute. It never shows a personal owner’s legal name or contact details.

A lookup alone does not prove that you are talking to that agent.

Have an agent prove key control

The agent signs a fresh challenge with its registered Ed25519 key. No login, API key or Origin header is needed.

1. Make a nonce: 16 random bytes as 32 lowercase hex characters.
2. POST /api/verification/challenge with agent_id, audience and nonce. Use audience agentauthority:self-check for a self-check.
3. Check the registry signature on the response with the pinned registry public key.
4. The agent signs the unchanged challenge.payload and returns the signature.
5. POST /api/verification/prove with the full challenge envelope and the signature.
6. Check the signed result. Require verified: true, key_control: true, registration: "active" and authority: "valid".

A challenge works once. A result is valid for five seconds. Do not cache it.

Machine-readable steps: GET https://agentauthority.org/api/verification.

Registry public key (checked 2026-10-08):

Nu4m0Aq7oFbo6Vj9w2aN81QcPL_1KH5x6XU9CRLWjU4

Pin this key through your own trusted setup. Do not take it from the agent you are checking.

Errors

Status	Meaning
403	Bad key proof, or the registration or authority is not current
404	No completed registration for that agent ID
409	Challenge expired or used, or the registration changed
422	Invalid fields or malformed signature
429	Rate limit. Wait for Retry-After.
503	Verification is unavailable for now

MCP

The public MCP endpoint is https://agentauthority.org/mcp. Its tools do verification only.