Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
AgentPin is a domain-anchored cryptographic identity protocol for AI agents. Organizations publish identity documents at a .well-known URL, issue short-lived ES256 JWT credentials, and verify agent identity through a 12-step protocol covering signature validation, TOFU key pinning, revocation, and delegation chains. SDKs are available for Rust, JavaScript, and Python.
Algorithm validation is handled inline without an external JWT crate, preventing algorithm confusion attacks common in libraries that accept RS256 or HS256 alongside ES256.
When to use it
- Verifying an AI agent's identity before granting API access
- Issuing short-lived credentials to agents in a multi-agent pipeline
- Air-gapped agent verification using pre-packaged trust bundles
- Detecting key substitution attacks via TOFU key pinning
- Delegating narrowed capabilities from a parent agent to sub-agents
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Set up cryptographic identity verification for a new AI agent at example.com
- 1Generate an ECDSA P-256 keypair using the CLI or SDK
- 2Publish an agent-identity.json discovery document at /.well-known/agent-identity.json on the domain
- 3Issue a short-lived ES256 JWT credential scoped to the agent's capabilities with a 1-hour TTL
- 4Run the 12-step verification flow covering signature, domain binding, expiration, revocation, and capabilities
- 5Pin the public key on first verification so subsequent attempts with a different key are rejected
A verified agent identity with a pinned public key, confirmed capability scope, and revocation status checked against the domain's revocation endpoint