The open identity
protocol for AI agents.
Domain-anchored, federated, and free to self-host. Your agents prove who they are, signed by your keys, anchored to your DNS, verifiable by anyone, and owned by no one.
Ed25519
cryptography
1 line
to integrate
Phase 3
live now
Features
Everything agents need to prove they're real
Built like Stripe. Think of GentID as a passport system for AI agents: cryptographically sound and developer-first.
Verified Identities
Cryptographic identity for every AI agent, anchored to the issuing organization's own domain. Assurance climbs three tiers: domain, organization, settlement history.
Secure by Design
Ed25519 keypairs generated on your infrastructure and never transmitted. Hosted nodes keep them encrypted at rest and exportable anytime.
Interoperable
A universal identity standard. Verify any GentID agent from any language or system against its own domain, with no shared database.
Full Lifecycle Control
You own your agent's identity. Revoke, suspend, or rotate keys at any time. Full audit log included.
Scoped Credentials
Signed certificates carry scopes, spending ceilings, and expiry that only narrow down the delegation chain. Any relying party verifies them offline, with no shared secrets.
Approval Thresholds
Set spending or action limits per agent. Actions above threshold send a real-time push to the human owner for approve/reject.
One-Line Integration
npm install @gentid/auth, then one line of middleware. Express, Next.js, and Cloudflare Workers all supported.
Ed25519
cryptography standard
<1ms
local verify latency
SOC 2
compliant architecture
99.99%
hosted node uptime SLA
Cryptographic
GentID
AI Agent Passport
Agent Identity
payments-agent
GIDP<<ACME.COM<<<<<<<<<<<<<<<<<<<<
ACME.COM:OPS:PAYMENTS-AGENT<<ACTIVE<<ED25519
Verified · Trusted · Built for the AI Economy
Cryptographic Identity
Every agent gets
a passport.
When you create an agent with GentID, it receives a unique cryptographic identity backed by Ed25519 keypairs: a verifiable passport it carries into every interaction, transaction, and system boundary.
Unforgeable
Every signature is mathematically tied to the agent's keypair. No impersonation possible.
Portable
The identity travels with the agent across any API, service, or ecosystem.
Auditable
Every action is logged with a cryptographic signature you can verify independently.
How it works
Live in minutes. Trusted forever.
Anchor your domain
Publish one DNS TXT record. Your domain — not anyone's database — becomes the root of trust for every agent you issue.
$ npx @gentid/cli init --domain delta.com
# Publish this record, then check-dns:
_gentid.delta.com. IN TXT
"v=gentid1; k=ed25519; p=mK4x…"Issue from your own node
Keys are generated locally and never leave your machines. Delegations narrow: teams get ceilings, agents get less. Revoke a key, kill its subtree.
$ gentid delegate create --name ops \
--ceiling USD,500,2000,10000
$ gentid agent issue --name rebooker-7 \
--under ops --scopes booking:rebook
# → gentic:agent:delta.com:ops:rebooker-7Anyone verifies, anywhere
Pure cryptography against the agent's own domain. Offline-capable after caching. No central registry — verifying delta.com's agents never touches gentid.com.
// local verification, not a REST call
const id = await verifyChain(bundle,
anchors); // from DNS + .well-known
id.domain // "delta.com"
id.assurance // 1 = domain-verifiedThe trust model
Like email, but for agent identity.
Email solved federated trust thirty years ago: DKIM anchors a sender's legitimacy in its own DNS. GentID applies the same architecture to AI agents.
gentic:agent:delta.com:* because only delta.com controls delta.com's DNS.A scammer can download this exact software and run it perfectly, and still cannot sign as delta.com, because trust lives in DNS, not in the code and not in our database.
Swarms & delegation
A thousand agents.
One kill switch per branch.
Your org root signs department keys. Departments sign agent certificates. Every link in the chain can only narrow what its parent granted: scopes shrink, spending ceilings shrink, lifetimes shrink. An agent can never hold a power its chain doesn't justify, and the math is checked by every verifier on earth, not by a policy engine you have to trust.
Compromise a department key? Revoke it once. Every agent underneath it stops verifying everywhere within seconds, including at services you've never talked to.
delta.com root key
unlimitedoffline, in your HSM
ops
USD 500/tx · 10k totaldepartment delegation
rebooker-7
USD 200/txagent · 60-day cert
seat-swap-1
USD 50/txagent · 60-day cert
support
read-only · no spenddepartment delegation
triage-2
no spendagent · 60-day cert
The real opportunity
The internet was built
for humans.
Websites know how to handle logins, passwords, and sessions. But autonomous AI agents? They're invisible to the infrastructure the internet runs on. That's the gap GentID closes.
Today
Tomorrow
Any website.
AI-agent ready in 15 minutes.
GentID is the integration layer that makes the existing internet compatible with AI agents, without websites having to rebuild anything. The same way Stripe abstracted payments and OAuth abstracted login, GentID abstracts agent trust.
One install
npm install @gentid/auth, then one line of middleware and you're done.
New user type
Sites recognize agents as a new class of user alongside humans and bots.
Built-in trust
Identity, permissions, and spending limits verified in every request.
// npm install @gentid/auth
import { gentidAuth } from '@gentid/auth';
// One line. That's it.
app.use(gentidAuth());
// Now your routes can do:
app.post('/book', (req, res) => {
const { id, domain, grants, assurance } = req.gentid;
// verified against the agent's own domain. no registry.
});POST /book HTTP/1.1
GentID-Envelope: eyJ0eXAiOi… // signed, nonced, body-bound
GentID-Bundle: eyJhZ2VudE… // cert + delegation chain
// → req.gentid, verified with pure cryptography:
{
"id": "gentic:agent:delta.com:ops:booker",
"domain": "delta.com",
"assurance": 1, // domain-verified
"grants": { "scopes": ["booking:*"] }
}Future vision
Your AI agent, acting in the real world
When every website supports GentID, your AI agents can safely transact, book, and act on your behalf, within rules you set.
Book a Delta flight
via your AI assistant
Order an iPhone from Apple
with human approval for large purchases
The AI never sees your raw card. The AI never pretends to be human. GentID verifies the authority; regulated enforcers hold the money. Websites recognize agents as a new class of user, with verified identity, scoped permissions, and delegated payment authority.
Roadmap
From identity to the full
AI agent economy
We're building in layers, starting with the cryptographic foundation and expanding into the complete trust, permissions, and payment infrastructure that autonomous AI needs.
Identity Foundation
Every AI agent gets a cryptographic identity: an Ed25519 keypair, a unique ID, and a verifiable public record.
- Domain-anchored agent identities
- Local keypairs, cryptographic signing & verification
- Organization verification (domain + KYC)
- Webhooks & real-time events
- TypeScript SDK on npm
Permissions & Delegation
Not just who the agent is, but what it's allowed to do, on whose behalf, and for how long.
- Scoped delegation certificates per agent
- Owner delegation with approval thresholds
- Chain verification for third parties
- Time-limited & revocable authority
- Push notifications for approvals
Agent Gateway
Any website becomes AI-agent ready in 15 minutes. One npm install. No rebuild required.
- @gentid/auth Express middleware
- Next.js middleware plugin
- "AI Agent Compatible" trust badge
- Cloudflare Worker integration
- Offline-verifiable envelopes & bundles
The Mandate Standard
Signed, verifiable spending authorizations issued through the same delegation chain. Verifiable by anyone. Enforceable by regulated settlement institutions.
- gentid.mandate.v1: limits, scopes, expiry
- Ceilings that only narrow down the chain
- Human-approval thresholds & escrow rules
- HTTP 402 binding: escrow, then retry
- Card / virtual-card tokens as one execution rail
The Trust Network
Reputation generated by settlement outcomes, as signed receipts from enforcers, and carried by GentID identities everywhere.
- Signed settlement receipts (gentid.receipt.v1)
- Tier 1: domain-verified
- Tier 2: org-verified attestations
- Tier 3: transaction-proven history
- Portable across every relying party
The first mandate enforcer is Atheries — the settlement layer for the agent economy, from the same team. The mandate format and enforcer interface are open: any regulated institution can implement them.
Human World
- 1Passport
- 2Login / OAuth
- 3Signed cheque
- 4Credit history
AI World
- 1GentID identity
- 2Delegation chain
- 3Mandate
- 4Settlement receipts
Analogous to
- 1DKIM (email)
- 2TLS cert chains
- 3Direct-debit mandate
- 4Credit bureau
Why federated
- 1Anchored in your DNS
- 2Verified by anyone
- 3Enforced by institutions
- 4Earned, not claimed
Trust model
Three tiers of verifiable trust
Trust isn't binary. Assurance climbs from domain control to institutional verification to proven settlement history, and every tier is checkable cryptography, not our say-so.
Domain-verified
The agent's chain anchors to its domain's DNS and signed .well-known document. Proves control of the domain, computed locally by every verifier.
- DNS TXT anchor (_gentid.domain)
- Signed .well-known/gentid.json
- Ed25519 chain verification
Org-verified
A recognized attestation authority has done KYC/KYB on the organization and signed an attestation that travels with every bundle.
- Signed org-verified attestations
- Legal name & jurisdiction claims
- Verifier chooses its authorities
Transaction-proven
Reputation earned, not claimed: signed settlement receipts from regulated enforcers, carried by the identity everywhere it goes.
- gentid.receipt.v1 history
- Signed by settlement institutions
- Portable across relying parties
What tier 1 does not prove: domain-verified proves an agent belongs to a domain, not that the domain is honest. de1ta.comcan be domain-verified too. Lookalike-domain risk is what org verification and transaction-proven history exist to solve. If a vendor tells you tier 1 alone means "safe," they're selling something.
Architecture
No central registry. One shared protocol.
Every organization runs its own identity node and owns its own agents' keys, anchored in its own DNS. GentID defines the format they all speak, so any of them can verify any other.
Apple
identity.apple.com
OpenAI
identity.openai.com
Delta
agents.delta.com
Your company
gentid.your-domain.com
GentID Protocol
Agent ID format · DNS anchoring · verification spec
Each organization owns
An agent id like gentic:agent:delta.com:ops:rebooker-7 is self-describing. Any verifier resolves the issuer straight from the id, with no lookup against a shared database required.
- Root signing key
- Delegation tree
- Revocation list
- Trust metadata
Open source
Open by design
Trust infrastructure should be transparent. GentID is open source, so you can read every line, run it yourself, or let us host it for you. Every instance speaks the same discovery protocol, so agents issued by yours and agents issued by ours can still verify each other.
Open standard
The token format and verification logic are public and auditable. An identity layer earns trust by being inspectable, not by being a black box.
Self-host for free
Run the full GentID stack on your own infrastructure under the MIT license. No vendor lock-in, no per-seat fees, no surprises.
Built in the open
SDKs, middleware, and the spec live on GitHub. File issues, read the source, send a pull request, or fork it. The roadmap is public.
Pricing
Simple, transparent pricing
Self-host it free, or let us run it. Scale as your agents grow.
Self-hosted
Run the entire GentID stack on your own infrastructure. Unlimited agents and verifications, no license fees, full control of your data. You bring the servers.
Free
forever, self-managed
Or let us host it
Free
A managed node anchored to your domain. No card required.
- Managed node, anchored to YOUR domain
- 10 agent identities
- Unlimited verifications, always free
- Key export & self-host migration
- Community support
Pro
For teams running production agent fleets.
- 100 agent identities
- Delegation trees & spending ceilings
- Org verification (tier-2 attestation)
- Revocation webhooks & audit log
- Email support
Enterprise
Unlimited scale, SLAs, and dedicated infrastructure.
- Unlimited agents & delegations
- Offline-root key ceremony support
- Dedicated managed node
- Custom attestation workflows
- SLA + priority support
FAQ
Common questions
OAuth authenticates humans delegating access to an app on their behalf. GentID authenticates autonomous AI agents acting independently, proving not just who authorized the agent but what it's allowed to do and within what limits, without a human in the loop for every action.
The future is agentic.
Identity is foundational.
GentID is the cryptographic passport that powers trust in the AI economy. Start issuing verifiable identities to your agents today.
Ed25519
cryptography
1 TXT record
anchors your domain
Offline
verification after caching