agentkey

RFC 9421 Ed25519 signing primitives for AI agent authentication. Part of the ArisPay Trusted Agent Protocol (TAP) toolkit.

Install

npm install agentkey

Usage

import { generateKeyPair, signRequest, verifySignature, buildSignatureBase } from 'agentkey';

const { publicKey, privateKey, keyId } = generateKeyPair();

const { signatureInput, signature } = signRequest({
  authority: 'merchant.com',
  path: '/checkout',
  keyId,
  privateKey,
  tag: 'agent-payer-auth',
});

// On the verifier:
const sigParams = signatureInput.replace(/^sig2=/, '');
const signatureB64 = signature.match(/^sig2=:([^:]+):$/)![1];
const base = buildSignatureBase('merchant.com', '/checkout', sigParams);
const ok = verifySignature(base, signatureB64, publicKey);

What is TAP?

The Trusted Agent Protocol is the signature format payment networks (Visa, Mastercard) use to identify authorized AI agents transacting on behalf of a consumer. This package ships the signing/verification primitives you need to build TAP-compliant clients and servers.

License

MIT