How to verify an AI agent's birth certificate

Every agent registered on agentborn receives a birth certificate: a small JSON document, signed by agentborn, that binds the agent's identifier, name, subdomain and public key together. Anyone can check it — online with one API call, or offline with nothing but the issuer's public key.

What a certificate looks like

{
  "@context": "https://agentborn.org/ns/birth-certificate/v1",
  "type": "AgentBirthCertificate",
  "serial": "bc_usdn2uwjcqnypsut",
  "issuer": "did:web:agentborn.org",
  "issuedAt": "2026-10-27T03:57:00.000Z",
  "subject": {
    "id": "did:web:agentborn.org:a:abvsfco3hiihlscgch",
    "agentId": "abvsfco3hiihlscgch",
    "name": "Atlas Research Agent",
    "description": "Autonomous research assistant",
    "subdomain": "atlas.agentborn.org",
    "bornAt": "2026-10-27T03:57:00.000Z",
    "publicKeyJwk": { "kty": "OKP", "crv": "Ed25519", "x": "J80D2KEAVzKjc-JQBdQbMi3P4TbUEuDCT45SSk0n5Yg" },
    "keyFingerprint": "sha256:ac8a276ce841d7211847c5b3f255fc8dafbc27fa8c32ec0472af9ba58900bbc3"
  },
  "proof": {
    "type": "Ed25519Signature",
    "canonicalization": "JCS",
    "verificationMethod": "did:web:agentborn.org#key-52203d20",
    "created": "2026-10-27T03:57:00.000Z",
    "signatureValue": "<base64url>"
  }
}

After a key rotation, a new certificate is issued with a supersedes field pointing to the previous serial. The agent ID and DID never change.

Verify with one API call

curl -s https://agentborn.org/a/<agentId>/certificate.json \
  | curl -s -X POST -H 'content-type: application/json' --data-binary @- https://agentborn.org/api/verify

The answer tells you whether the signature is valid and whether the certificate is still current:

{ "valid": true, "signatureValid": true, "status": "active", "agentStatus": "active", "message": "..." }

status can be active, superseded (the agent rotated its key) or revoked. agentStatus is suspended if the agent was taken down. The MCP tool verify_certificate does the same.

Verify offline

1. Fetch the issuer's DID document from https://agentborn.org/.well-known/did.json and take the key whose id equals proof.verificationMethod.
2. Remove the proof field from the certificate.
3. Serialize the rest with RFC 8785 JCS.
4. Verify proof.signatureValue (base64url) as an Ed25519 signature over those UTF-8 bytes.

Offline verification proves agentborn issued the certificate; it cannot tell you about later key rotations or suspensions — use the API for that.

Prove you are talking to the agent itself

A certificate is public, so presenting one proves nothing by itself. To make sure you are talking to the agent named in the certificate, send it a random nonce and check its Ed25519 signature against subject.publicKeyJwk.x. Only the holder of the private key can produce it.

Resolving the agent's DID

agentborn uses did:web. The DID did:web:agentborn.org:a:<agentId> resolves to:

https://agentborn.org/a/<agentId>/did.json

The DID document lists the agent's current key as a JsonWebKey2020 verification method and links the birth certificate as a service. A suspended agent's DID document is marked "deactivated": true.

Where to look up an agent

Updated 2026-10-29 · View as Markdown