Smufye Agent SA Smufye Agent
Try the demo

Stripe Atlas for AI agents

Identity for AI agents.

Issue a signed passport for your agent in one API call. Anyone can verify it. Every check is logged.

Try the live demo Read the docs

No signup. No API key. Thirty seconds.

terminal
$ curl -X POST https://api.agentsmufye.com/v1/agents \
    -d '{"name":"my-agent"}'

{ "agent_id": "ag_…", "passport": "eyJ…" }

$ curl -X POST https://api.agentsmufye.com/v1/verify \
    -d '{"passport":"eyJ…"}'

{ "valid": true, "agent_id": "ag_…" }

Issue

One POST registers your agent and returns a signed passport.

Verify

Anyone checks the passport with one call. valid: true.

Audit

Every issuance and verification is timestamped and logged.

How it works

01

Issue

Register your agent with one POST. You get back a signed passport — a standard ES256 JWT only we could have signed.

POST /v1/agents
{ "name": "my-agent" }

02

Verify

Anyone — a user, another agent, an auditor — checks the passport with one call and gets a straight answer.

POST /v1/verify
{ "passport": "eyJ…" }

03

Audit

Every issuance and revocation is written to an append-only log with a timestamp. A record exists — it is not a compliance certification.

{ "event": "passport.verified",
  "agent_id": "ag_…",
  "at": "2026-09-26T…" }

Live demo

This calls the real API. No signup, no key — issue a passport and verify it right here.

A passport proves our key signed it — not who operates the agent.

1 Issue a passport

Demo passports expire 24 hours after issuance and are marked as demos.

Your passport will appear here.

2 Verify it

Uses the passport you just issued. Checks the signature, expiry, and revocation status.

The verdict will appear here.

3 Your audit trail

A live illustration of what the audit log records for your actions above. Every issue and verification also writes a real timestamped entry server-side.

Issue or verify a passport above and the entries appear here.

Billing opens soon — leave your email and we'll tell you. We'll only email about billing. See our Privacy Policy.

Why it matters

An agent books, buys, and messages on your behalf — and the other side takes its word for it. Smufye Agent gives every agent a verifiable identity, so counterparties can confirm our key signed it before they engage.

Regulators are asking the same question. The EU AI Act requires logging for high-risk AI systems — those obligations phase in through 2027–2028. The audit trail keeps that log for you automatically, so the record exists before it's required.

Questions developers actually ask

FAQ

How is this different from OAuth or API keys?

OAuth proves a user approved access; a passport proves our key signed the claim about which agent acted — to anyone, with no login flow. It does not prove who operates the agent. API keys are shared secrets you manage and rotate; passports are signed credentials anyone can verify.

Who holds the signing keys?

We do, on Cloudflare's edge. Your agents never touch private keys — they just carry their passport, and verification needs only our published public key.

What if your API goes down?

Passports are standard ES256 JWTs. Cache our public key once and verify signatures anywhere — including offline; revocation checks call the API, and a passport that can't be checked doesn't pass.

How do I cut off a rogue agent?

Revoke its passport with one call — you'll need the revoke token returned when the passport was issued, so nobody else can kill your credential. Every later verification fails with reason revoked, and the revocation lands in your audit log.

Does the audit trail satisfy the EU AI Act?

The Act requires logging for high-risk AI systems — those obligations phase in through 2027–2028. We timestamp and store every issuance and revocation now, so a tamper-evident record already exists. This is not a compliance certification.

Pricing

Pay as you go

$0.10 / verification

For side projects and experiments.

  • Issue unlimited passports
  • Pay only when someone verifies
  • Full audit trail included
Try it free

For production teams

Production

$199 / month

For teams running agents in production.

  • Unlimited verifications
  • Unlimited passports
  • Full audit trail included
Try it free

Unlimited means no meter — fair use applies (exact monthly limit published before billing starts).

Billing isn't wired up yet — the API is free while we finish it.

Docs

Quickstart

No API key needed. Copy, paste, done.

Rate limits: 10 issues and 60 verifications per minute per IP — no key needed.

quickstart.sh
# 1. Issue a passport for your agent
curl -X POST https://api.agentsmufye.com/v1/agents \
  -d '{"name":"my-agent"}'
# → { "agent_id": "ag_…", "passport": "eyJ…" }

# 2. Verify it (anyone can do this)
curl -X POST https://api.agentsmufye.com/v1/verify \
  -d '{"passport":"eyJ…"}'
# → { "valid": true, "agent_id": "ag_…" }

# 3. Read an agent's public identity
curl https://api.agentsmufye.com/v1/agents/ag_…
# → { "agent_id": "ag_…", "name": "my-agent", … }

API reference

MethodEndpointDescription
POST /v1/agents Register an agent and issue its passport. Body: {"name"}. Returns agent_id, passport, passport_id, and a one-time revoke_token. Impersonation-style names are blocked (400); bodies over 64KB are rejected (413); issuance is throttled per IPv6 /64 in addition to edge rate limits.
GET /v1/agents/:id Public identity document for an agent: id, name, status, and the issuer's public key.
POST /v1/verify Verify a passport. Body: {"passport"}. Returns {"valid": true, "agent_id", "name", "demo", "expires_at"} — or a reason it's not. Bodies over 64KB are rejected (413).
POST /v1/passports/:id/revoke Revoke a passport immediately. Requires the revoke_token returned once at issuance. Later verifications return {"valid": false, "reason": "revoked"}.
POST /v1/waitlist Join the billing waitlist. Body: {"email"}.
GET /health Service health. Returns {"ok": true}.
Try the live demo