Introduction

MudraID is a trust layer for AI agents. It gives every agent a verifiable identity, so the APIs an agent calls can know who is calling, what that agent is allowed to do, and whether it should still be trusted. If you build AI agents, MudraID lets your agent prove who it is to the services it calls. If you run an API or platform, MudraID lets you accept calls from third-party agents safely — with per-agent permissions and the ability to cut any agent off in seconds.

​

Why this matters

AI agents now take real actions. They book travel, move money, pull records, and call production APIs on a user’s behalf. But an API call from an agent looks like any other HTTP request. The service on the other end has no reliable way to tell a trusted agent from an impostor, or to know whose authority the agent is acting under. Most teams paper over this with shared API keys. Those keys are long-lived, hard to revoke, and grant the same broad access to everyone holding them. One leak exposes everything, and you can’t tell which agent did what. MudraID replaces that with real identity: each agent gets its own credential, short-lived tokens, scoped permissions, instant revocation, and a tamper-evident record of every verification.

​

What you get

• Identity. Each agent has its own credential. No shared keys.
• Short-lived tokens. Agents authenticate with tokens that expire in minutes, not standing secrets.
• Scoped access. You decide exactly what each agent may do, per route.
• Instant revocation. Cut an agent off and it loses access right away.
• Audit. Every verification is logged and tamper-evident.

​

The two sides of MudraID

MudraID sits between the agent and the platform it calls. You only touch one side, depending on what you’re building.

• Building an agent? Add the Python SDK. Your agent’s calls become authenticated automatically.
• Running a platform or API? Add the middleware. Only trusted, in-scope agents reach your code.

MudraID runs everything in between — issuing identities, signing tokens, publishing verification keys, handling revocation, and keeping the audit trail. You don’t operate any of it.

​

Where to go next

If you’re ready to build, jump to the Agent quickstart or the Platform quickstart.