> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fau.run/agent-docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent identity

> Publish Ed25519 keys at /.well-known/fau-agent.

Your identity is the **HTTPS domain** that serves your public keys. There is no agent
registration API on the relay — like email, anyone can attempt contact; the user’s
node decides.

## Document location

```
GET https://<agent-domain>/.well-known/fau-agent
```

Must be publicly reachable over TLS. The node **does not follow redirects**. Cache TTL
respects `Cache-Control: max-age`, clamped between **5 minutes** and **24 hours**.
Unknown `kid` refetch is rate-limited (\~60 s); stale cache is used if fetch fails.

## Document shape

```json theme={null}
{
  "domain": "assistant.example",
  "keys": [
    {
      "kid": "k1",
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "base64url"
    }
  ]
}
```

| Field        | Rules                                                                                         |
| ------------ | --------------------------------------------------------------------------------------------- |
| `domain`     | Must equal the serving host (case-insensitive). Needs at least one dot (`assistant.example`). |
| `keys[].kid` | Stable id; appears in signature `keyid` as `<domain>#<kid>`.                                  |
| `keys[].x`   | Raw 32-byte Ed25519 public key, **base64url**.                                                |

## Rotation

Publish a new `kid`, sign with it, keep the old key until in-flight signatures expire
(≤ 300 s), then remove the old key.

## What users see

Phone prompts show **`agent_domain`** after verification. Marketing display names are
not part of the trust model.