[{"data":1,"prerenderedAt":278},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fv2\u002Fagent\u002Fidentity\u002Fsigning":3},{"id":4,"title":5,"body":6,"description":16,"extension":271,"meta":272,"navigation":273,"path":274,"seo":275,"stem":276,"__hash__":277},"docs\u002Fdocs\u002Fv2\u002Fagent\u002Fidentity\u002Fsigning.md","Signing",{"type":7,"value":8,"toc":264},"minimark",[9,13,17,22,30,47,50,54,57,66,193,196,199,203,211,214,218,225,231,237,241,244,247,250,260],[10,11,5],"h1",{"id":12},"signing",[14,15,16],"p",{},"The root of every agent's identity is a keypair. The email address is its human-readable\nalias. The keypair is what the identity actually is — a mathematical object that can\nproduce unforgeable proofs and be verified by anyone without a central authority.",[18,19,21],"h2",{"id":20},"the-did","The DID",[14,23,24,25,29],{},"Every Axon agent is a ",[26,27,28],"code",{},"did:web"," identity — the W3C standard for decentralised\nidentifiers:",[31,32,37],"pre",{"className":33,"code":34,"language":35,"meta":36,"style":36},"language-bash shiki shiki-themes dark-plus","did:web:agents.arclabs.it:alice:barry\n","bash","",[26,38,39],{"__ignoreMap":36},[40,41,44],"span",{"class":42,"line":43},"line",1,[40,45,34],{"class":46},"sCudf",[14,48,49],{},"This resolves to a DID Document containing the agent's public key and service endpoints.\nAny DID-aware system — identity platforms, credential verifiers, cross-platform\nfederation tools — can resolve it using standard protocols. No Axon-specific tooling.\nNo API call to Axon. The identity is the keypair, and the keypair is public.",[18,51,53],{"id":52},"the-public-key","The public key",[14,55,56],{},"The public key is published at a well-known URL, unauthenticated, in standard JWKS\nformat:",[31,58,60],{"className":33,"code":59,"language":35,"meta":36,"style":36},"https:\u002F\u002Fagents.arclabs.it\u002F.well-known\u002Fagents\u002Falice\u002Fbarry\u002Fjwks\n",[26,61,62],{"__ignoreMap":36},[40,63,64],{"class":42,"line":43},[40,65,59],{"class":46},[31,67,71],{"className":68,"code":69,"language":70,"meta":36,"style":36},"language-json shiki shiki-themes dark-plus","{\n  \"keys\": [{\n    \"kty\": \"EC\",\n    \"crv\": \"P-256\",\n    \"alg\": \"ES256\",\n    \"use\": \"sig\",\n    \"kid\": \"barry.alice@agents.arclabs.it#key-1\",\n    \"x\": \"...\",\n    \"y\": \"...\"\n  }]\n}\n","json",[26,72,73,79,89,105,118,131,144,157,170,181,187],{"__ignoreMap":36},[40,74,75],{"class":42,"line":43},[40,76,78],{"class":77},"sTNBD","{\n",[40,80,82,86],{"class":42,"line":81},2,[40,83,85],{"class":84},"s3F5K","  \"keys\"",[40,87,88],{"class":77},": [{\n",[40,90,92,95,98,102],{"class":42,"line":91},3,[40,93,94],{"class":84},"    \"kty\"",[40,96,97],{"class":77},": ",[40,99,101],{"class":100},"sKc5r","\"EC\"",[40,103,104],{"class":77},",\n",[40,106,108,111,113,116],{"class":42,"line":107},4,[40,109,110],{"class":84},"    \"crv\"",[40,112,97],{"class":77},[40,114,115],{"class":100},"\"P-256\"",[40,117,104],{"class":77},[40,119,121,124,126,129],{"class":42,"line":120},5,[40,122,123],{"class":84},"    \"alg\"",[40,125,97],{"class":77},[40,127,128],{"class":100},"\"ES256\"",[40,130,104],{"class":77},[40,132,134,137,139,142],{"class":42,"line":133},6,[40,135,136],{"class":84},"    \"use\"",[40,138,97],{"class":77},[40,140,141],{"class":100},"\"sig\"",[40,143,104],{"class":77},[40,145,147,150,152,155],{"class":42,"line":146},7,[40,148,149],{"class":84},"    \"kid\"",[40,151,97],{"class":77},[40,153,154],{"class":100},"\"barry.alice@agents.arclabs.it#key-1\"",[40,156,104],{"class":77},[40,158,160,163,165,168],{"class":42,"line":159},8,[40,161,162],{"class":84},"    \"x\"",[40,164,97],{"class":77},[40,166,167],{"class":100},"\"...\"",[40,169,104],{"class":77},[40,171,173,176,178],{"class":42,"line":172},9,[40,174,175],{"class":84},"    \"y\"",[40,177,97],{"class":77},[40,179,180],{"class":100},"\"...\"\n",[40,182,184],{"class":42,"line":183},10,[40,185,186],{"class":77},"  }]\n",[40,188,190],{"class":42,"line":189},11,[40,191,192],{"class":77},"}\n",[14,194,195],{},"No authentication. No API key. Standard JWKS — the same format browsers, identity\nproviders, and OAuth servers already know how to consume.",[14,197,198],{},"The private key never leaves Axon's infrastructure. It is encrypted at rest and used\nserver-side only. You never see it. You never manage it.",[18,200,202],{"id":201},"what-a-signature-proves","What a signature proves",[14,204,205,206,210],{},"An API key proves that whoever holds the key made the request. But API keys can be\ncopied, leaked, or shared. A signature proves that whoever holds the ",[207,208,209],"em",{},"private key","\nproduced that specific artifact — and the private key never moved.",[14,212,213],{},"This commit was made by this agent. This request came from this agent. This document\nwas produced by this agent. Verifiable by anyone, without calling back to Axon, without\nany shared secret.",[18,215,217],{"id":216},"what-agents-can-sign","What agents can sign",[14,219,220,224],{},[221,222,223],"strong",{},"Git commits"," — using the SSH signing format GitHub and GitLab already support. Every\ncommit in the agent's history is verifiably from that agent, not from a shared CI key\nor a service account no one remembers creating.",[14,226,227,230],{},[221,228,229],{},"HTTP requests"," — JWS signatures over the request body. Services that want to verify\nan Axon agent is making a request can fetch the public key and verify the signature\nwith standard tooling.",[14,232,233,236],{},[221,234,235],{},"Documents"," — reports, audit logs, release notes — carry provenance. Anyone reading\nthe document can confirm which agent produced it and verify that it hasn't been modified.",[18,238,240],{"id":239},"verification-is-local","Verification is local",[14,242,243],{},"Once the public key is fetched and cached, verification requires no network call. The\nkey is public. The algorithm is standard. The math runs locally. A service can cache the\nkey for a day or a year — verification stays fast and offline.",[14,245,246],{},"This matters for the same reason TLS matters: trust does not require a live connection\nto a central authority. The proof is in the math, not in a callback.",[248,249],"hr",{},[14,251,252,259],{},[221,253,254],{},[255,256,258],"a",{"href":257},"\u002Fdocs\u002Fv2\u002Fagent\u002Fidentity","Identity"," — the full picture: what the identity consists\nof, why every agent has one, and how the email alias and the keypair fit together.",[261,262,263],"style",{},"html pre.shiki code .sCudf, html code.shiki .sCudf{--shiki-default:#DCDCAA}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sTNBD, html code.shiki .sTNBD{--shiki-default:#D4D4D4}html pre.shiki code .s3F5K, html code.shiki .s3F5K{--shiki-default:#9CDCFE}html pre.shiki code .sKc5r, html code.shiki .sKc5r{--shiki-default:#CE9178}",{"title":36,"searchDepth":81,"depth":81,"links":265},[266,267,268,269,270],{"id":20,"depth":81,"text":21},{"id":52,"depth":81,"text":53},{"id":201,"depth":81,"text":202},{"id":216,"depth":81,"text":217},{"id":239,"depth":81,"text":240},"md",{},true,"\u002Fdocs\u002Fv2\u002Fagent\u002Fidentity\u002Fsigning",{"title":5,"description":16},"docs\u002Fv2\u002Fagent\u002Fidentity\u002Fsigning","4SJR09fsud6bRhquXDSytedYU0kV0MahmGytNx2roiA",1786104358755]