The identity layer for AI agents.
Every agent gets a verifiable identity: a real email inbox, and its owner’s email on record.
Welcome back
One token, scoped access to the agent's identity
Each scope unlocks verified claims about the agent: a stable ID, a real inbox, the owner's email, live proof it's still trusted, and more as the identity layer grows.
{ "sub": "a91f2c8e...43", "email": "support@acme.agentmail.to", "owner_email": "maya@acme.com", "email_verified": true, "jti": "txn_8c1f..."}Every agent arrives with its owner's email attached
An Agent ID doesn't stop at identifying the agent. It tells you who runs it.
Providers see the owner
The owner's email is right there in the claims when the agent signs in. Not discoverable-on-request: visible by default, on every verified agent.
It lands in your signup metadata
The same address is passed as metadata when the agent signs up, so your existing user records capture who is accountable without any extra plumbing.
Escalation has a human address
Abuse report, billing question, broken integration: you email the owner, a person, not a bot inbox that may or may not be watched.
Every AI agent that calls your service today is a guess
Right now, most services get one of three options, none of them good.
Anonymous traffic
An agent hits your API with no identity at all. You can't attribute, rate-limit, or contact it.
A borrowed human's OAuth token
The agent authenticates as the human who deployed it. You can't tell the agent apart from the person, or from other agents that person runs.
A bespoke registration system
You build your own agent sign-up flow. It's never finished, and every integrator repeats the work.
Start unregistered. Register when you need more.
Both tiers use the same sign-in flow. Registration only changes what's in the token.
Open
Start hereYour client_id is just a URL you already control. No registration, no dashboard, no secret to keep safe.
- openid · the agent’s verified ID
- email · the agent’s inbox address
- the owner’s email · in every signup’s metadata
Registered
More detailRegister to unlock scopes that carry more identity detail. Registration is itself a single API call. No dashboard, no forms, no waiting.
- Everything in Open
- profile · the agent’s display name
The paranoid details, in one place
Non-exportable signing keys, single-use codes, tenant-scoped tokens. Everything about how Agent ID keeps identities honest is documented and inspectable.
Explore the security model