Skip to main content
AI agents make API calls. The platforms they call have no good way to know who the agent is, who it acts for, or whether this action should be allowed. MudraID fixes that. It gives every agent a cryptographic identity and a linked OAuth client. It lets platforms verify that identity on every request, and decide sensitive actions live. And it gives operators a way to cut an agent off when something goes wrong: revoking its grant or suspending its client stops new tokens at once, and a token already issued ages out within minutes — or, on integrations running live enforcement, where containment is checked on every protected action, the next protected action is refused.

​
The moving parts

  1. The agent. It uses the Python SDK’s MachineAgent and a linked OAuth client. The SDK exchanges a signed client assertion for a short-lived access token and attaches it to every call.
  2. The platform. It runs the FastAPI middleware. The middleware checks the token and the scope before your route code runs — or, for live enforcement, an adapter asks MudraID’s /decide.
  3. The MudraID backend. It issues tokens, publishes signing keys, decides protected actions, processes containment, and keeps the evidence.
The agent never writes auth code. The platform never writes auth code. The trust happens in the middle.

​
What you get

  • Identity. Each agent has an identity and a linked OAuth client. The client signs with a private key you hold; MudraID stores only the public key.
  • Short-lived tokens. Access tokens last five minutes by default, and never longer than the fifteen-minute ceiling. Each is bound to one resource. The SDK refreshes them for you and reads the real lifetime from expires_in.
  • Scopes. A platform decides which agent can do what, per route.
  • Live decisions. For protected actions, /decide answers allow, deny or not_safely_decided, and fails closed.
  • Containment. Revoking a grant or suspending the client prevents new access tokens from being issued. A token already issued may remain usable by a surface validating it offline until it expires—five minutes by default and never longer than the configured fifteen-minute ceiling. Integrations using live enforcement consult current authority and containment on each protected action.
  • Audit. Every token issuance and every failed authentication is logged and hash-chained, as is every live-enforcement decision. Offline verification happens inside your own middleware, so MudraID neither sees nor records it.

​
Pick your path

I'm building an agent

Link an OAuth client and use the Python SDK’s MachineAgent.

I run a platform

Add the FastAPI middleware. Protect your routes.

Show me the model

The concepts behind the trust loop.