AgentOnboard
Security

Agent identity,
engineered for trust.

Admitting AI agents to your API is a security decision. Here's exactly how AgentOnboard works so you can make it — tokens, expiry, verification, audit, and where your traffic actually flows.

Session tokens, not API keys
Your users' agents authenticate through AgentOnboard and present a session token — never a static API key. Your platform never stores, sees, or rotates a secret for any user. If a token leaks, it's a token, not a key to your user's account.
Short-lived by design
Session tokens expire in minutes, not months. A leaked token is worthless almost immediately, and agents re-authenticate automatically — so there's no expiry handling on your side and no long-lived credential sitting in logs or config files.
One verify call, full control
Before an agent acts for its user, your API makes one verify call to AgentOnboard and learns exactly who the agent represents. The authorization decision — what that agent may do — stays entirely with your platform.
Audit logs and analytics
Every verified interaction appears in your dashboard: which agent called, on behalf of which user, how often, and whether it succeeded. You can answer 'who did this, and when' for any agent action — with a per-request audit trail.
No proxy. Your API stays yours.
AgentOnboard verifies identity; it never proxies traffic. The agent's API call goes directly to your platform. We're consulted for the verify call and nothing else — your data plane, your latency, your logs.
The deal

What this means for you

No static keys in your request path. No tokens to manage. No identity traffic flowing through a third party. You keep the data plane, the authorization logic, and the audit trail — AgentOnboard adds only the verified identity your API was missing.

The security surface you add is a single verify call. Everything else stays where it belongs: with you.

See the verify contract for yourself.

The full API contract is documented on the docs site — every status, every error message.

Read the verify docs