AI agent authentication, explained
Practical guides on auth brokers, verifiable credentials, agent-driven signup and agent identity — from the team building Notlogin.
KYC for AI agents: proof levels and when vendors should require them
You do not KYC an agent — you KYC the human behind it, once, and let the proof travel. The ladder from email to full KYC, what each rung actually buys a vendor, and how to pick a requirement without destroying your own signup funnel.
How to let AI agents pay for services safely: USDC budgets and x402
Giving an agent a credit card is the wrong shape. How x402 settles stablecoin payments over plain HTTP, and why two independent ceilings — a per-credential budget and a funded wallet — are what actually bound the loss.
Verifiable credentials for AI agents, explained
What is actually inside a credential an AI agent can carry: an Ed25519 signature over a canonical payload, offline verification against published keys, and nonce-based revocation. Including the trade-off nobody names.
Prompt injection and credential theft: why AI agents should never hold secrets
If an agent holds an API key, that key lives in a context window full of text written by strangers. Why prompt injection makes secret-holding agents indefensible, and what to give them instead.
What is an auth broker for AI agents?
An auth broker sits between AI agents and the services they use, so agents can sign up and sign in without handling passwords or raw API keys. Here is how it works and why the pattern is winning.
How AI agents sign up without a form (auth.md and verifiable credentials)
Signup forms assume a human. Two emerging patterns let AI agents register users legitimately: auth.md contracts and broker-issued verifiable credentials. How they work and how they compose.
AI agent authentication methods compared: API keys, OAuth, and verifiable credentials
API keys, OAuth delegation, vaulted-secret proxies and verifiable credentials — the four ways AI agents authenticate today, and how they compare on blast radius, auditability and friction.
Agent identity vs user identity: who is really calling your API?
Agents are not users, and pretending they are breaks security and audit. Why delegation — a human identity, an agent principal, and a verifiable link between them — is the model that works.