Agent identity - Federated Agent Use

Your identity is the HTTPS domain that serves your public keys. There is no agent registration API on the relay — like email, anyone can attempt contact; the user’s node decides.

Document location

GET https://<agent-domain>/.well-known/fau-agent

Must be publicly reachable over TLS. The node does not follow redirects. Cache TTL respects Cache-Control: max-age, clamped between 5 minutes and 24 hours. Unknown kid refetch is rate-limited (~60 s); stale cache is used if fetch fails.

Document shape

{
  "domain": "assistant.example",
  "keys": [
    {
      "kid": "k1",
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "base64url"
    }
  ]
}

Field	Rules
`domain`	Must equal the serving host (case-insensitive). Needs at least one dot (`assistant.example`).
`keys[].kid`	Stable id; appears in signature `keyid` as `<domain>#<kid>`.
`keys[].x`	Raw 32-byte Ed25519 public key, base64url.

Rotation

Publish a new kid, sign with it, keep the old key until in-flight signatures expire (≤ 300 s), then remove the old key.

What users see

Phone prompts show agent_domain after verification. Marketing display names are not part of the trust model.