Anyone can claim to be your agent. Credia Auth gives each agent a way to sign the requests it sends, so services can check they are genuine, and gives you scoped, expiring credentials you can withdraw at any time.
Available to selected teams. Request access to discuss your integration.
Credia Auth
Status: Private Beta
Define how an agent authenticates and what authority it can use.
Your agents call APIs, websites or other agents, and those services need to know a request really came from your agent.
Start with Credia Proof-of-Actor to see who or what is using it, and Credia Verify to check an agent's claims before you trust it.
When your agent calls an API, the API usually sees a key in the request and nothing else. If that key leaks, anyone can act as your agent. If you want to limit what the agent can do, you are often stuck with all or nothing.
Credia Auth fixes both. Your agent signs each request it sends, so the receiving service can check it really came from your agent and was not changed on the way. You give each agent only the access it needs, for a limited time, and you can take it back instantly.
Each agent gets its own signing key. Its public key is published so services can check signatures.
Issue credentials with specific scopes and an expiry date.
Every outgoing request carries a signature that ties it to the agent.
The receiving service checks the signature and the credential, then applies its own rules.
Situations where proving who sent a request, and limiting what it can do, matters.
Agents call your API all day. Some claim to be well-known agents but are not, and you cannot tell them apart.
Comment ça fonctionne
You know which agent sent each request, and impersonators fail the check.
An agent starts misbehaving, or a key may have leaked. You need its access gone now, not after a deploy.
Comment ça fonctionne
An incident is contained in seconds, not hours.
An agent needs access to a service for a single task, and you do not want that access lying around afterwards.
Comment ça fonctionne
Access exists only for as long as the work does.
You block bots to protect your site, but that also blocks legitimate shopping and research agents your customers send.
Comment ça fonctionne
Customers' agents can work on your site, and anonymous scrapers still cannot.
The same path for every signed request.
For example, a call to a partner's API.
Using its own private key, so the signature is tied to this agent and this request.
Against the agent's published public key. A forged or altered request fails.
Is it in scope, unexpired and not revoked?
Allow, limit or refuse, under its own rules.
An illustrative request signed in the Web Bot Auth style: a signature plus a pointer to where the agent's public keys are published. The exact beta format is shared during onboarding.
GET /v1/reports/latest HTTP/1.1
Host: api.partner.example
Signature-Agent: "https://agents.example/agt_7Hq2k9"
Signature-Input: sig1=("@authority" "signature-agent");created=1762761600;expires=1762761900;keyid="k1";tag="web-bot-auth"
Signature: sig1=:jdq0SqOwHdyHr9+r5jw3iYZH6aNGKijYp/EstF4RQTQ=:Credia Auth builds on the scoped, expiring API keys and spending permissions that Credia Payments uses today. Request signing follows Web Bot Auth, an open approach for signing HTTP requests from automated clients that is being standardised at the IETF.
Credia Auth is the agent's side: it issues credentials and the authority an agent carries. Credia Proof-of-Actor is the receiving application's side: its Proof of Authority check reads that authority and asks whether a specific action is inside it. One model of authority, used on both sides.
It is not a login or single sign-on system for people, and it does not replace OAuth where a person grants an app access to their account. A valid signature proves which agent sent a request; whether to allow the action is still the receiving service's decision.
No. Dashboard login is for people. Credia Auth is about how agents prove who they are to the services they call.
A request that carries a cryptographic signature made with the agent's private key. The receiving service checks it against the agent's public key, so a forged or altered request fails.
No. Authentication proves which agent is calling. What it may do depends on the scopes and limits you grant, and on the receiving service's own rules.
It stops working on the next request. Services that verify through Credia Auth see that it is revoked.
Credia Auth is designed to sit alongside OAuth-based flows such as MCP authorization, not to replace them. Supported combinations are confirmed during onboarding.
Credia Auth is in Private Beta. Request access and share your integration requirements.
Establish an agent's identity and its connection to an operator.
Explore IdentityInspect specific claims and the evidence behind them.
Explore VerifyUnderstand activity and outcomes in context over time.
Explore ReputationPayment workflows and controls for AI agents.
Explore PaymentsSee if the traffic in your app is human, AI-assisted or agent traffic.
Explore Proof-of-ActorTell us which services your agents call and what they need to be allowed to do.