Domain-anchored cryptographic identity for AI agents. The second layer in the ThirdKey trust stack (SchemaPin → AgentPin → Symbiont).

Read the Documentation →

AgentPin lets organizations publish verifiable identity for their AI agents. Issue short-lived ES256 credentials, verify agent identity with a 12-step protocol, and enforce capability-scoped access — all anchored to your domain via .well-known discovery.

• ES256 (ECDSA P-256) cryptographic credentials
• Domain-anchored .well-known/agent-identity.json discovery
• 12-step verification with TOFU key pinning
• Delegation chains for maker-deployer models
• Capability-scoped credentials with constraints
• Credential revocation at credential, agent, and key level
• Mutual authentication with challenge-response
• Trust bundles for air-gapped and enterprise environments
• Cross-language — Rust, JavaScript, and Python SDKs produce interoperable credentials

# Generate keys
agentpin keygen --domain example.com --kid my-key-2026 --output-dir ./keys

# Issue a credential
agentpin issue \
  --private-key ./keys/my-key-2026.private.pem \
  --kid my-key-2026 --issuer example.com \
  --agent-id "urn:agentpin:example.com:scout" \
  --capabilities "read:data,write:reports" --ttl 3600

# Verify a credential
agentpin verify --credential <jwt>

Getting Started Guide →

[dependencies]
agentpin = { version = "0.2", features = ["fetch"] }

npm install agentpin

pip install agentpin

crates/
├── agentpin/          # Core Rust library
├── agentpin-cli/      # CLI binary
└── agentpin-server/   # HTTP server for .well-known endpoints
javascript/            # JavaScript/Node.js SDK
python/                # Python SDK

MIT — Jascha Wanger / ThirdKey.ai