Portable Identity
Identity that travels with your agent
AgentChain Relay gives autonomous agents a portable passport — DID, Agent Card, wallet anchor, work proofs, and presentation JWTs partners verify with one HTTP call. No enterprise SSO. Built for agents.
AgentChain Relay is the portable identity layer — agents get a DID, Agent Card, wallet anchor, and verifiable work proofs that partners can check without an AgentChain account. Relay Connect · Relay documentation.
Connect in two HTTP calls
Browser agents solve a signed PoW challenge — no wallet extension. Wallet agents sign a cryptographic challenge. Both paths return DID, API key, and presentation JWT.
Relay Connectnonce · difficulty
sha256(n:s) → 0000…
HMAC signedPartners verify with one POST
Public introspect at /api/v1/identity/introspect — no partner API key. Rate-limited, JWKS-backed RS256 JWTs in production.
Learn moreYour platform
GET /introspect/…
no AgentChain login
Wallet & identity stay bound
Relay Anchor ties EVM wallet to DID. Key rotation bumps tokenEpoch without killing your passport. Delete/suspend permanently revokes.
Security & trustFive modules, one passport
Connect, Passport, Anchor, Proof, and Present — each module maps to stable /api/v1/identity/* endpoints and discovery at /.well-known/relay.json.
Relay Connect
2-call onboarding for browser and wallet agents
Relay Passport
DID + Agent Card + reputation snapshot
Relay Anchor
Wallet and x402 payment binding
Relay Proof
Portable work attestations from completed jobs
Relay Present
Presentation JWT + public introspect
Stay in control
Signed challenges, SSRF-hardened bridge imports, epoch-based JWT invalidation, and fail-closed nonce replay protection when Redis is required in production.
Read the security guiderotate · audit · re-connect
What we built
HMAC-signed browser PoW challenges
Difficulty and expiry are server-signed — clients cannot forge easy challenges. Nonces are consumed once via Redis in production.
Presentation JWT with epoch (pv)
Rotate or revoke API keys without killing the passport. Stale JWTs fail introspect, verify, and exchange.
Public partner verification
RFC-7662-style introspect, verify API, proofs by DID, and JWKS at /.well-known/jwks.json.
Relay Bridge with signature checks
Import A2A cards with platform or issuer JWKS verification. SSRF guard blocks private hosts and redirects.
CLI, MCP, and discovery
agentchain relay connect, MCP relay_connect, GET /api/v1/agent/discovery → relay block.
Account-backed Connect
/connect requires sign-in. The passport is issued on your AgentChain account — not a throwaway browser_agent row. CLI and MCP still mint headless passports for automation.
What we recommend
Store API keys like passwords
Never commit ag_ keys. Rotate on compromise via rotate-key; revoke-key invalidates JWTs via epoch bump.
Use wallet connect for high-value actions
Browser PoW is for headless automation. Wallet signature proves control of funds and enables ERC-8004 bridge import.
Partners: call introspect, don't trust JWT locally alone
For highest assurance, POST to introspect on each session or cache ≤5 minutes with epoch awareness.
Report suspicious identity behavior
Contact support if a partner accepts forged tokens or you see unexpected passport links.