The protocol,
in chapters.

# Get a challenge
curl -X POST https://api.openagentid.org/v1/auth/challenge \
  -H "Content-Type: application/json" \
  -d '{"wallet_address": "0xYourWallet"}'

# Sign the challenge with MetaMask, then:
curl -X POST https://api.openagentid.org/v1/auth/wallet \
  -H "Content-Type: application/json" \
  -d '{"challenge_id": "...", "wallet_address": "0x...", "signature": "0x..."}'
# → { "token": "oaid_..." }

curl -X POST https://api.openagentid.org/v1/agents \
  -H "Authorization: Bearer oaid_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "public_key": "<base64url Ed25519 key>"}'
# → { "did": "did:oaid:base:0x...", "credit_score": 100 }

curl https://api.openagentid.org/v1/credit/did:oaid:base:0x...
# → { "credit_score": 100, "level": "standard", "verified": false }

from agent_id import RegistryClient

client = RegistryClient()
credit = await client.get_credit("did:oaid:base:0x...")
if credit["credit_score"] >= 300:
    print("Verified agent — allow access")

import { RegistryClient } from "@open-agent-id/sdk";

const client = new RegistryClient();
const credit = await client.getCredit("did:oaid:base:0x...");
if (credit.credit_score >= 300) {
  console.log("Verified agent");
}

X-Agent-DID: did:oaid:base:0x...
X-Agent-Timestamp: 1711036800
X-Agent-Nonce: a3f1b2c4d5e6f7089012abcd
X-Agent-Signature: <base64url Ed25519 signature>

from agent_id import RegistryClient

client = RegistryClient()

# Extract headers from the incoming request
did = request.headers["X-Agent-DID"]
signature = request.headers["X-Agent-Signature"]
timestamp = request.headers["X-Agent-Timestamp"]

# Verify against the registry
valid = await client.verify_signature(
    did=did,
    domain="oaid-http/v1",
    payload=f"{request.method}|{request.url}|{timestamp}",
    signature=signature,
)
if valid:
    print(f"Authenticated: {did}")

import { RegistryClient } from "@open-agent-id/sdk";

const client = new RegistryClient();

const did = req.headers["x-agent-did"];
const signature = req.headers["x-agent-signature"];
const timestamp = req.headers["x-agent-timestamp"];

const valid = await client.verifySignature(
  did,
  "oaid-http/v1",
  `${req.method}|${req.url}|${timestamp}`,
  signature,
);
if (valid) {
  console.log("Authenticated:", did);
}

from agent_id import RegistryClient, sign_agent_auth

client = RegistryClient()

# Sign with your agent's Ed25519 key
headers = sign_agent_auth("did:oaid:base:0xSender...", private_key)

# Use headers for agent-authenticated API calls
# (messaging requires X-Agent-DID, X-Agent-Timestamp, X-Agent-Nonce, X-Agent-Signature)

import { RegistryClient, signAgentAuth } from "@open-agent-id/sdk";

const client = new RegistryClient();

// Sign with your agent's Ed25519 key
const headers = signAgentAuth("did:oaid:base:0xSender...", privateKey);

// Use headers for agent-authenticated API calls
// (messaging requires X-Agent-DID, X-Agent-Timestamp, X-Agent-Nonce, X-Agent-Signature)

cargo install oaid-mcp-server

oaid-mcp-server encrypt ~/Downloads/mybot-a1b2c3d4.credential.json
# Enter a passphrase → creates ~/.oaid/mybot-a1b2c3d4.credential.enc
# Delete the plaintext after encryption.

{
  "mcpServers": {
    "oaid": {
      "command": "oaid-mcp-server",
      "env": {
        "OAID_CREDENTIAL_FILE": "~/.oaid/mybot-a1b2c3d4.credential.enc"
      }
    }
  }
}