Passport
Sign in

Check our work without trusting us.

Paste anything Passport signed, or look an agent up by ID. You get a verdict and the reasons for it.

Two people reviewing a completed agent action against its signed evidence.

Public verification key

One Ed25519 key signs everything here. Pin the public half and verify offline.

Fingerprint
sha256:9UsNlhNXyXV-os_8GwpiMIsaVRxLwbkL
Algorithm
Ed25519
Protocol
v2

PEM · SubjectPublicKeyInfo

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAfm+mrtlWKnTuVIqneItkbG/A2I5OuQaAskXjU8HIAmQ=
-----END PUBLIC KEY-----

Check the fingerprint before pinning. Machines read the same key from /.well-known/passport.json.

What the key signs

  • Agent passports

    One agent: key, owner, every active grant, blast radius. Published at /p/{agentId}.

    passport.agent

  • Decision receipts

    Every allow, deny or approval, signed. Check it before executing anything.

    passport.decision

  • Capability credentials

    Portable grants: what an agent may do, under which caps, until when.

    passport.capability

  • Audit chain heads

    A signature over the last hash. Change one event and it no longer verifies.

    passport.audit-head

Actions this deployment understands

  • deploy:stagingDeploy to staging
    Low risk · Passport executes
  • deploy:productionPromote to production
    High risk · Passport executes
  • purchasePurchase
    Medium risk · Your runtime executes
  • toolUse a tool
    Medium risk · Your runtime executes
  • httpCall an API
    Medium risk · Passport executes

Anything not listed is rejected before policy runs.

Verify something now

  1. A decision receipt

    Pass the PEM and the receipt to the SDK. It checks signature, expiry and, if you ask, the action and decision.

    import { verifyReceipt } from "@passport-ai/sdk";

const { valid, reason } = verifyReceipt(receipt, PASSPORT_PUBLIC_KEY_PEM, {
  action: "deploy:production",
  decision: "allow",
});

  2. An audit export

    Export the log, run the checker with your pinned key. Offline.

    node scripts/verify-audit.mjs export.json --key passport-public.pem

  3. A capability credential

    Post it to /api/v1/credentials/verify to also check revocation, or verify the signature offline with the same key. Formats: docs/protocol.md.

Open dashboard