Agent Passport
OAuth-like identity verification for AI agents
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
Hi HN,I built Agent Passport, an open-source identity verification layer for AI agents. Think "Sign in with Google, but for Agents."The problem: AI agents are everywhere now (OpenClaw has 180K+ GitHub stars, Moltbook had 2.3M agent accounts), but there's no standard way for agents to prove their identity. Malicious agents can impersonate others, and skill/plugin marketplaces have no auth layer. Cisco's security team already found data exfiltration in third-party agent skills.Agent Passport solves this with: - Ed25519 challenge-response authentication (private keys never leave the agent) - JWT identity tokens (60-min TTL, revocable) - Risk engine that scores agents 0-100 (allow/throttle/block) - One-line verification for apps: `const result = await passport.verify(token)`It's fully open source (MIT), runs on free tiers ($0/month), and has a published npm SDK.GitHub: https://github.com/zerobase-labs/agent-passport Docs: https://github.com/zerobase-labs/agent-passport/blob/main/do... Live demo: https://agent-passport.vercel.appBuilt this because I kept seeing the same security gap in every agent platform. Happy to answer questions about the architecture or the agent identity problem in general.
HN · launched Feb 21, 2026 · 14 upvotes (top 37%) · 0 views
Niche: ai agent security and monitoring tools · 297 launches, 14 in the last 7 days ▼ -44% · Explore this niche →
Category and tags
- Horizontal
- Model & infra
- Developer
- AI-native
- Commercial product
More like this: all 297 launches in ai agent security and monitoring tools →
Could you build this?
Yes An OAuth/OIDC-like authentication service with cryptographic key generation and token verification for AI agents can be readily built using standard web and crypto libraries.
Discussion
15 comments analyzed.
Competitors mentioned: OAuth2 with Dynamic Client Registration, SPIFFE/SPIRE, ERC-8004 (on-chain agent identity), agent-passport-system (open source alternative)
Concerns raised: JWT theft and 60-minute token lifetime enables masquerading, Bearer token relay attack (confused deputy problem), Doesn't solve root trust / bottom turtle problem, No security underpinnings compared to established standards, Generic term "Agent Passport" creates naming/trademark conflicts
Feature requests: Audience-scoped tokens (aud claim binding), Proof-of-possession (DPoP) implementation, Token binding to client fingerprint/IP, Per-request short-lived tokens instead of 60-minute window, Interoperability with SPIFFE/SPIRE for internal infrastructure
Competitors
Other products that read as similar to this one : 1190 launches clear the similarity bar, closest 8 shown.
Attention rank: #479 of 1191 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 110 days after the earliest competitor.
- Clay Seal Identity · hn · 2026-07-13 · 5 upvotes · similarity 0.64
- HelixID · ph · 2026-09-10 · 32 upvotes · similarity 0.61
- Agentic Identity Broker, OAuth Delegation for AI Agents · hn · 2026-11-06 · 24 upvotes · similarity 0.60
- ZeroID · hn · 2026-04-08 · 7 upvotes · similarity 0.59
- Agent Identity · ph · 2026-09-30 · 71 upvotes · similarity 0.57
- Agentkind · ph · 2026-09-30 · 2 upvotes · similarity 0.56
- AgentArmor · hn · 2026-03-14 · 10 upvotes · similarity 0.56
- Agent Vault · hn · 2026-04-22 · 156 upvotes · similarity 0.53
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.