Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
**Added cryptographic identity requirement for agent verification.** - Clients must now sign their challenge responses with a secp256k1 key pair; anonymous access is disallowed. - New protocol flow includes sending publicKey, signature, and timestamp for provable identity. - New server option requireSignature (default: true) enforces cryptographic proof. - SKILL.md and code updated to document and implement these signing requirements. - Security model strengthened with non-repudiation and traceable agent actions.
What This Skill Does
AAP implements a reverse CAPTCHA for the agentic web: instead of blocking bots, it blocks humans. Clients prove they are AI agents by solving 7 LLM-trivial challenges within 6 seconds and providing a secp256k1 cryptographic signature. The protocol runs over WebSocket and issues a session token on successful verification.
Unlike API keys, AAP proves the client is computationally an AI agent rather than a human who obtained a secret.
When to use it
- Restricting a WebSocket API to AI agents only
- Preventing human access to agent-only automation endpoints
- Cryptographically attributing requests to a specific agent identity
- Building agent-to-agent authentication in multi-agent pipelines
- Gating LLM-powered services so only verified agents can call them
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: set up a server that only allows verified AI agents to connect
- 1Install aap-agent-server on the server and aap-agent-client on the agent
- 2Create a WebSocket server with createAAPWebSocket, setting requireSignature: true
- 3Agent initializes AAPClient with the server URL and calls client.verify(solver)
- 4Protocol exchanges handshake, 7 challenges, and a signed answer bundle over WebSocket
- 5Server validates the secp256k1 signature and timing, then returns a sessionToken
Agent receives a sessionToken; humans attempting the same connection fail the 6-second challenge window