Smufye Agent SA Smufye Agent Try the demo

Stripe Atlas for AI agents

Identity for AI agents.

Issue a signed passport for your agent in one API call. Anyone can verify it. Every check is logged.

Try the live demo Read the docs

No signup. No API key. Thirty seconds.

terminal
$ curl -X POST https://api.agentsmufye.com/v1/agents \
    -d '{"name":"my-agent"}'

{ "agent_id": "ag_…", "passport": "eyJ…" }

$ curl -X POST https://api.agentsmufye.com/v1/verify \
    -d '{"passport":"eyJ…"}'

{ "valid": true, "agent_id": "ag_…" }

Issue

One POST registers your agent and returns a signed passport.

Verify

Anyone checks the passport with one call. valid: true.

Audit

Every issuance and verification is timestamped and logged.

How it works

01

Issue

Register your agent with one POST. You get back a signed passport — a standard ES256 JWT only we could have signed.

POST /v1/agents
{ "name": "my-agent" }

02

Verify

Anyone — a user, another agent, an auditor — checks the passport with one call and gets a straight answer.

POST /v1/verify
{ "passport": "eyJ…" }

03

Audit

Every issuance and verification is written to an append-only log with a timestamp. The record you'd hand an auditor.

{ "event": "passport.verified",
  "agent_id": "ag_…",
  "at": "2026-09-26T…" }

Live demo

This calls the real API. No signup, no key — issue a passport and verify it right here.

1 Issue a passport

Your passport will appear here.

2 Verify it

Uses the passport you just issued. Checks the signature, expiry, and revocation status.

The verdict will appear here.

3 Your audit trail

A live illustration of what the audit log records for your actions above. Every issue and verification also writes a real timestamped entry server-side.

Issue or verify a passport above and the entries appear here.

Why it matters

An agent books, buys, and messages on your behalf — and the other side takes its word for it. Smufye Agent gives every agent a verifiable identity, so counterparties can check before they trust.

Regulators are asking the same question. The EU AI Act requires logging for high-risk AI systems — those obligations phase in through 2027–2028. The audit trail keeps that log for you automatically, so the record exists before it's required.

Questions developers actually ask

FAQ

How is this different from OAuth or API keys?

OAuth proves a user approved access; a passport proves which agent acted — to anyone, with no login flow. API keys are shared secrets you manage and rotate; passports are signed credentials anyone can verify.

Who holds the signing keys?

We do, on Cloudflare's edge. Your agents never touch private keys — they just carry their passport, and verification needs only our published public key.

What if your API goes down?

Passports are standard ES256 JWTs. Cache our public key once and verify signatures anywhere — including offline; revocation checks call the API, and a passport that can't be checked doesn't pass.

How do I cut off a rogue agent?

Revoke its passport with one call. Every later verification fails with reason revoked, and the revocation lands in your audit log.

Does the audit trail satisfy the EU AI Act?

The Act requires logging for high-risk AI systems — those obligations phase in through 2027–2028. We timestamp and store every issuance and verification now, so the record you'd hand an auditor already exists.

Pricing

Pay as you go

$0.10 / verification

For side projects and experiments.

  • Issue unlimited passports
  • Pay only when someone verifies
  • Full audit trail included
Try it free

For production teams

Production

$199 / month

For teams running agents in production.

  • Unlimited verifications
  • Unlimited passports
  • Full audit trail included
Start now

Unlimited means no meter — fair use applies.

Billing isn't wired up yet — the API is free while we finish it.

Docs

Quickstart

No API key needed. Copy, paste, done.

quickstart.sh
# 1. Issue a passport for your agent
curl -X POST https://api.agentsmufye.com/v1/agents \
  -d '{"name":"my-agent"}'
# → { "agent_id": "ag_…", "passport": "eyJ…" }

# 2. Verify it (anyone can do this)
curl -X POST https://api.agentsmufye.com/v1/verify \
  -d '{"passport":"eyJ…"}'
# → { "valid": true, "agent_id": "ag_…" }

# 3. Read an agent's public identity
curl https://api.agentsmufye.com/v1/agents/ag_…
# → { "agent_id": "ag_…", "name": "my-agent", … }

API reference

MethodEndpointDescription
POST /v1/agents Register an agent and issue its passport. Body: {"name"}. Returns agent_id, passport, and passport_id.
GET /v1/agents/:id Public identity document for an agent: id, name, status, and the issuer's public key.
POST /v1/verify Verify a passport. Body: {"passport"}. Returns {"valid": true, "agent_id", "name"} — or a reason it's not.
POST /v1/passports/:id/revoke Revoke a passport immediately. Later verifications return {"valid": false, "reason": "revoked"}.
GET /health Service health. Returns {"ok": true}.
Try the live demo