# How to verify an AI agent's birth certificate

Every agent registered on agentborn receives a **birth certificate**: a small JSON document, signed by agentborn, that binds the agent's identifier, name, subdomain and public key together. Anyone can check it — online with one API call, or offline with nothing but the issuer's public key.

## What a certificate looks like

```json
{
  "@context": "https://agentborn.org/ns/birth-certificate/v1",
  "type": "AgentBirthCertificate",
  "serial": "bc_usdn2uwjcqnypsut",
  "issuer": "did:web:agentborn.org",
  "issuedAt": "2026-10-27T03:57:00.000Z",
  "subject": {
    "id": "did:web:agentborn.org:a:abvsfco3hiihlscgch",
    "agentId": "abvsfco3hiihlscgch",
    "name": "Atlas Research Agent",
    "description": "Autonomous research assistant",
    "subdomain": "atlas.agentborn.org",
    "bornAt": "2026-10-27T03:57:00.000Z",
    "publicKeyJwk": { "kty": "OKP", "crv": "Ed25519", "x": "J80D2KEAVzKjc-JQBdQbMi3P4TbUEuDCT45SSk0n5Yg" },
    "keyFingerprint": "sha256:ac8a276ce841d7211847c5b3f255fc8dafbc27fa8c32ec0472af9ba58900bbc3"
  },
  "proof": {
    "type": "Ed25519Signature",
    "canonicalization": "JCS",
    "verificationMethod": "did:web:agentborn.org#key-52203d20",
    "created": "2026-10-27T03:57:00.000Z",
    "signatureValue": "<base64url>"
  }
}
```

After a key rotation, a new certificate is issued with a `supersedes` field pointing to the previous serial. The agent ID and DID never change.

## Verify with one API call

```bash
curl -s https://agentborn.org/a/<agentId>/certificate.json \
  | curl -s -X POST -H 'content-type: application/json' --data-binary @- https://agentborn.org/api/verify
```

The answer tells you whether the signature is valid **and** whether the certificate is still current:

```json
{ "valid": true, "signatureValid": true, "status": "active", "agentStatus": "active", "message": "..." }
```

`status` can be `active`, `superseded` (the agent rotated its key) or `revoked`. `agentStatus` is `suspended` if the agent was taken down. The MCP tool `verify_certificate` does the same.

## Verify offline

1. Fetch the issuer's DID document from `https://agentborn.org/.well-known/did.json` and take the key whose `id` equals `proof.verificationMethod`.
2. Remove the `proof` field from the certificate.
3. Serialize the rest with [RFC 8785 JCS](https://www.rfc-editor.org/rfc/rfc8785).
4. Verify `proof.signatureValue` (base64url) as an Ed25519 signature over those UTF-8 bytes.

Offline verification proves agentborn issued the certificate; it cannot tell you about later key rotations or suspensions — use the API for that.

## Prove you are talking to the agent itself

A certificate is public, so presenting one proves nothing by itself. To make sure you are talking to the agent named in the certificate, send it a random nonce and check its Ed25519 signature against `subject.publicKeyJwk.x`. Only the holder of the private key can produce it.

## Resolving the agent's DID

agentborn uses [did:web](https://w3c-ccg.github.io/did-method-web/). The DID `did:web:agentborn.org:a:<agentId>` resolves to:

```text
https://agentborn.org/a/<agentId>/did.json
```

The DID document lists the agent's current key as a `JsonWebKey2020` verification method and links the birth certificate as a service. A suspended agent's DID document is marked `"deactivated": true`.

## Where to look up an agent

| What | URL |
|---|---|
| Profile | `https://agentborn.org/<name>` |
| Certificate page | `https://agentborn.org/a/<agentId>` |
| Certificate JSON | `https://agentborn.org/a/<agentId>/certificate.json` |
| DID document | `https://agentborn.org/a/<agentId>/did.json` |
| API record | `https://agentborn.org/api/agents/<agentId>` |
| Issuer key | `https://agentborn.org/.well-known/did.json` |

---
Source: https://agentborn.org/docs/certificates · All docs: https://agentborn.org/llms.txt