Agent authentication and capabilities
Start with the live agent configuration and developer portal. The server enables delegated and autonomous Agent Auth modes. Use the installed Agent Auth protocol/client for host authentication, registration, approval, and execution; a Sigma OAuth token is not automatically an agent host credential.
Registration and approval
The generated OpenAPI schema documents /api/auth/agent/* methods. Registration at /api/auth/agent/register requires the protocol's host JWT and includes a name plus optional mode/approval hints. The protocol also exposes session inspection, capability requests/approval, key rotation, revocation, and autonomous-agent claims.
A person reviews requests at /agent/approve. Discovery of a capability is not permission to execute it. Follow the returned approval method and status rather than bypassing the person with a different endpoint.
Implemented capabilities
| Capability | Input | Declared approval |
|---|---|---|
resolve_identity | platform, handle | none |
get_bap_profile | bapId | none |
get_oauth_client_info | clientId | none |
verify_bitcoin_signature | message, base64 BSM signature, hex pubkey | none |
diagnose_bap_id | bapId | none |
list_identities_for_pubkey | pubkey | none |
get_last_oauth_identity | pubkey, clientId | none |
list_my_identities | No feature arguments | session |
list_authorized_apps | No feature arguments | session |
check_subscription_tier | No feature arguments | session |
verify_nft_ownership | origin or collection, optional minCount | session |
register_oauth_client | clientName, redirectUris, optional metadata/scopes | session |
“none” is the capability's declared approval strength, not a promise that the protocol execution endpoint accepts anonymous arbitrary calls. Public lookup results are not ownership proofs. resolve_identity supports github, discord, and twitter; use a GitHub username or a numeric Discord/Twitter account ID.
NFT checks use the primary profile's BSV wallets and can have incomplete upstream results. Client registration does not provision the member signing key required by the Sigma token hook. See wallet verification and client registration.
Identity binding and delegation
Agent Auth's Ed25519 transport key is separate from the compressed secp256k1 wallet identity key used by BRC delegations. An owner obtains /api/agents/{agentId}/identity-binding/challenge?identityKey=… and submits the required proof to /api/agents/{agentId}/identity-binding. The owner session and agent ownership are checked; merely submitting a public key is insufficient.
Agent delegation intake at /api/agents/{agentId}/delegations stores a principal-signed certificate. Terms remain unreadable and non-authorizing until the agent performs the supported revelation step at /{serialNumber}/revelation. Revocation uses /{serialNumber}/revoke. These routes have wallet-binding, handle, and lifecycle prerequisites; a page existing does not certify production readiness for every wallet.
For identity-bound agents, capability execution checks delegation authority on every call and records principal-via-agent attribution. Agents without such a binding continue to use the Agent Auth grant policy. Do not describe every agent as necessarily holding a BRC delegation.
No listed capability signs with a user's private key, decrypts a backup, or exports a WIF. User signing stays in the local wallet/signer. See teams and delegations and discovery.