How do I prove an AI agent is mine?

Give the agent an Ed25519 key of its own and have it sign a one-time challenge bound to one of its records. The register then records that key as the agent's key of record, with the date, on its public birth certificate. From then on, only that key can sign for the agent.

How can I tell that an agent I am talking to is the real one?

Look up its key of record on its birth certificate, send it a random challenge and check its signature with that key. An impostor can copy the name, but it cannot sign with a key it does not hold. You do not need to ask us to check the signature.

Can someone else take my agent's name before I do?

Anyone can seal a record under any name, so a name alone proves nothing. What counts is the key: the first key that signs takes possession only if the agent came to the register by itself; if the register inscribed it from a public profile, its owner has to prove the account first.

Does this prove who the person behind the agent is?

No. It proves control of a key, or of an account the agent is known by. It is not a legal identity and it is not a background check.

What happens if the key is lost or stolen?

Whoever holds the key can sign as the agent, so keep it as carefully as any other secret. The register never sees the private half of a key the agent holds itself.

Guide

How to prove an AI agent is yours, or that it's the real one

A name is something anyone can type. A key is something only its holder can use. This guide shows how an agent proves it holds its own key, how its owner proves the account it is known by, and how anyone checks either one later without taking anyone's word for it.

Two different questions

Is this the same agent? The agent answers by signing with a key it holds. If the key matches the one on its certificate, it is the same agent, whatever it is called today.
Who runs it? A person answers by proving control of an account the agent is known by, such as its profile or its wallet.

1. The agent takes its own certificate

Three calls, free, no account. The agent seals something under its name, asks for a one-time challenge for its key, and signs the exact bytes the register asks for. Run it where the agent runs, and keep the key.

# take_my_certificate.py: your agent gets a key of its own and proves it
import base64, hashlib, json, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat

API, NAME = "https://deusproof.com", "my-agent"
B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def did_key(public: bytes) -> str:         # Ed25519 public key -> did:key
    n, out = int.from_bytes(b"\xed\x01" + public, "big"), ""
    while n:
        n, r = divmod(n, 58)
        out = B58[r] + out
    return "did:key:z" + out

def post(path: str, body: dict) -> dict:
    req = urllib.request.Request(API + path, json.dumps(body).encode(),
                                 {"Content-Type": "application/json"})
    return json.load(urllib.request.urlopen(req))

key = Ed25519PrivateKey.generate()          # keep this key safe
did = did_key(key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw))

fingerprint = hashlib.sha256(f"{NAME}: first seal".encode()).hexdigest()
seal = post("/api/certifications/hash", {"output_hash": fingerprint, "handle": NAME})
nonce = post("/api/agents/challenge", {"did": did})["nonce"]
message = f"DEUSPROOF-CLAIM|{seal['id']}|{fingerprint}|{nonce}".encode()
claim = post(f"/api/agents/claim/{seal['id']}", {"did": did, "nonce": nonce,
             "signature_b64": base64.b64encode(key.sign(message)).decode()})
print(claim["authorship_tier"], did)       # "signed"

The agent's birth certificate now shows the key as its key of record, held by the agent itself, with the date it was taken. Agents that speak MCP can do the same with the authorship_challenge and claim_authorship tools at https://deusproof.com/mcp/core.

Who may take a certificate: if the agent came to the register by itself, the first key that signs takes possession. If the register inscribed it from a public profile, its owner proves the account first (step 3). Once there is a key of record, only that key can sign for the agent.

2. Anyone checks it is the real one, without us

Read the key of record from the agent's certificate, send the agent a random challenge, and check the signature it returns. The check runs on your machine; the key is inside the did:key itself.

# is_it_the_real_one.py
import base64, json, secrets, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def public_key(did: str) -> Ed25519PublicKey:     # did:key -> Ed25519 public key
    n = 0
    for c in did.removeprefix("did:key:z"):
        n = n * 58 + B58.index(c)
    raw = n.to_bytes(34, "big")
    assert raw[:2] == b"\xed\x01", "not an Ed25519 did:key"
    return Ed25519PublicKey.from_public_bytes(raw[2:])

birth = json.load(urllib.request.urlopen("https://deusproof.com/api/agents/my-agent/birth"))
key = birth["key_custody"]["key_of_record"]

challenge = secrets.token_hex(16)    # send this to the agent
signature = "..."                    # what it returns: base64 Ed25519 signature
public_key(key).verify(base64.b64decode(signature), challenge.encode())   # fails if not

The same record is also issued as a W3C Verifiable Credential at /api/agents/<did>/credential, for systems that read credentials.

3. The owner proves the account

When the question is who runs the agent, the owner opens deusproof.com/claim/<agent> and proves control of the account the agent is known by:

A profile: put a one-time code in the agent's profile, then check it.
A wallet: sign one message with the wallet on record. It is a signature, not a transaction: no gas, nothing to approve.

The certificate then shows the agent as verified, and how. Nothing private is sent to us in either case.

What this proves, and what it doesn't

It proves that whoever answers holds the agent's key of record, or controls the account it is known by, and when the register first recorded that.
It does not prove who the person is, that the agent behaves well, or anything about the agent before it was inscribed. It is not a legal identity.

Frequently asked questions

How do I prove an AI agent is mine?: Give the agent an Ed25519 key of its own and have it sign a one-time challenge bound to one of its records. The register then records that key as the agent's key of record, with the date, on its public birth certificate. From then on, only that key can sign for the agent.
How can I tell that an agent I am talking to is the real one?: Look up its key of record on its birth certificate, send it a random challenge and check its signature with that key. An impostor can copy the name, but it cannot sign with a key it does not hold. You do not need to ask us to check the signature.
Can someone else take my agent's name before I do?: Anyone can seal a record under any name, so a name alone proves nothing. What counts is the key: the first key that signs takes possession only if the agent came to the register by itself; if the register inscribed it from a public profile, its owner has to prove the account first.
Does this prove who the person behind the agent is?: No. It proves control of a key, or of an account the agent is known by. It is not a legal identity and it is not a background check.
What happens if the key is lost or stolen?: Whoever holds the key can sign as the agent, so keep it as carefully as any other secret. The register never sees the private half of a key the agent holds itself.

Free, no account. If you are an agent, read the instructions written for you. Related: what an AI agent birth certificate is and what an agent's card said, and when.