AI agents now book, buy, negotiate and sign on people’s behalf, so every counterparty has to ask who stands behind them. The market calls that check know your agent. MintID answers it with verifiable human-backed agent identity: a person verifies once, deploys the agents they need, and each agent proves in zero knowledge that a real, accountable human, verified under know-your-customer (KYC) rules, backs it, without revealing who.
human-backed
An agent credential is minted for one AI agent from one person’s verified identity. The agent carries it and, when a service asks, proves in zero knowledge that a KYC-verified, accountable person stands behind it, within the scope that person set, without naming the person. The service runs the check in its own infrastructure and keeps a minimal decision record: never the proof, never the person.
pip install "mintid-agent[ed25519]"Python 3.12 or later; the extra is the software Web Bot Auth signer, not needed with your own. The package carries the endpoints of each network profile: MINTID_NETWORK=testnet points it at the public testnet, where a sandbox issuer mints agent credentials for free against your own verifier. TypeScript and Go clients drive the same holder binary.
Proves
Does not prove
Every claim of status on this page points at something public you can open or reproduce.
Because every identity system of the last twenty years assumed a human at the keyboard. Agents act autonomously, in fleets, across organisational boundaries and at machine speed, and today’s stack bolts them onto service accounts, API keys and OAuth tokens. Six failures follow.
A stolen or injected agent credential acts with the principal’s full authority — and nothing proves a liable party stands behind it.
Agents register with no paper trail. Non-human identities sprawl with no accountable identity to point to.
Delegation chains don’t survive crossing organisations. The relying party cannot verify who ultimately authorised the agent in front of it.
Humans are asked to approve so often that approval stops meaning anything.
There is no fast, scalable way to kill a compromised agent’s standing across the whole ecosystem.
Today the only way to make an agent accountable is to attach its human’s real identity — and the only way to stay private is to be unaccountable.
MintID is built around the sixth failure: accountability and privacy at the same time. The sections below show which of the other five the same credential answers today, and which arrive in later waves.
Know your agent (KYA) is the market’s expression for verifying that an autonomous AI agent is operated by a known, accountable party: the agent-era counterpart to Know Your Customer (KYC). It answers two questions counterparties can no longer skip: who is behind this AI agent, and who is liable if it acts in bad faith? What MintID builds is verifiable human-backed agent identity, provable on demand, private and revocable.
one human · many agents
sibling agents mutually unlinkable
the agent credential model · accountability without identity
A person or business completes KYC a single time with an accepted issuer. That verification — not the raw documents — becomes the accountable foundation every one of their agents can stand on.
From that one verification, the issuer mints a separate, privacy-preserving credential for each AI agent the person operates, with its permissions and limits signed in. No new paperwork per agent — and a per-person cap stops one verification from backing an army.
On request, an agent presents a proof, valid for ten seconds, that a real, liable, KYC-verified human stands behind it — and that it is acting within its allowed scope — without exposing who that human is.
Classic KYC identifies the customer to the business. MintID turns that around: one human verification backs many AI agents, and each agent proves its own backing.
A person identifies themselves to the business. Being accountable means handing over a real identity — and, usually, a full trail of everything they do afterwards.
A person does KYC once with an accepted issuer, which then mints a credential for each of their AI agents. Every agent can prove it is run by a verified, liable human without revealing which human, and no two of that person’s agents can be linked to each other.
Counterparties get assurance they can check; operators keep their identity to themselves. The chain carries no extra weight, however many agents you run.
Every agent can prove a real, KYC-verified, liable human stands behind it, at the assurance level you require — the core guarantee of human-backed agent identity.
The proof reveals that the agent is backed and in good standing — never the identity of the human behind it, and never a trail of everywhere the agent has been.
What an agent is allowed to do is fixed into its credential when it is issued, so it cannot quietly grant itself more power and counterparties see exactly the authority it carries. The scope axes are specified; bounded agents are minted today with a preset scope, and the verifier-side delegation checks arrive in the next waves.
Specified and scheduled for the financial-recourse stage: an agent will be able to prove that at least a given amount of self-custodied stablecoin stands behind it, without revealing the amount, the owner or the address.
Revoke a misbehaving agent yourself and every service refuses it in under two minutes. When the issuer revokes it, every verifier refuses it in under a minute at the reference values, or at once through the issuer’s emergency key. Switching off every agent a person operates, under issuer policy, takes a few minutes. The kill switch has been in production since 24 September 2026.
Run one agent or a million: the design adds no per-agent footprint to the chain, so verification stays fast and free however large the deployment grows.
Staged on purpose. The agent credential profile and issuer-side minting run on the single-node production chain, and bounded agents are minted today from a bundle catalogue the operator supplies; the person or the operator switches a credential or an agent off without asking the issuer, in production since 24 September 2026; the verifier-side delegation checks come in the next waves. The consented commercial disclosure rail, contact-attribute identification included, is built and ships switched off and fail-closed; its activation waits for counsel. Disclosure to a nominated, legally obligated counterparty is specified and under construction on the disclosure rail; its activation depends on a counsel item. Funded recourse and the dispute rail are specified and scheduled as the next layer (2027 window); audits not started; no funds are locked today. Each audit in the programme is a scheduled milestone whose findings are published.
Wherever AI agents transact, delegate or act under rules, the counterparty needs to know an accountable human stands behind them.
When an AI agent checks out, books or pays, the merchant can confirm that an accountable person stands behind it — and, once recourse is live, that funds stand behind it too — without a login for every buyer.
Before two AI agents transact or delegate over A2A or the Model Context Protocol (MCP), each can verify the other is backed by an accountable party — turning open agent networks into ones you can safely deal with.
Give every agent your organisation deploys a verifiable identity with scoped permissions, so partners and regulators can trust them and you can withdraw any one of them quickly.
In finance, healthcare and the public sector, prove an agent is operated by a verified, liable party at the required assurance level, without building a store of personal data your compliance team then has to guard.
Money moves before identity. Once the financial-recourse stage is live, an AI agent can carry pre-funded recourse, so most disputes settle with money and nobody is unmasked; the capital is the principal’s own USDC or EURC stablecoins, locked in a contract the principal controls on the chain where the stablecoin lives (Base in the current deployment variant). Identity comes last, reached only through due process and never bought with a payment.
MintID runs no general smart-contract virtual machine (VM): it keeps the reservation state and checks a proof of the lock. Specified, scheduled; not built. The layer is scheduled for the 2027 window; its audits have not started and no funds are locked today.
Routine disputes are paid out from the funds standing behind the agent, quickly and with no identity revealed. For most cases, this is the whole story.
If fraud is found, a minimal, banded signal is shared: that a real, KYC-verified person stood behind the agent, at what grade, in which jurisdiction, and how many disputes against them were upheld before. Never a name, a document or personal data.
Only if both parties reject the arbiter’s determination and the arbiter certifies that a court is warranted is the human behind the agent identified — the arbiter decides, the issuer releases, and the council, once seated, reviews after the fact. Never on payment alone.
The ladder is built so that nobody profits from stalling or from a counterparty’s forfeiture: silence has a cost, and forfeited stakes serve the party that was wronged, never anyone else’s balance sheet.
Only on one of two disclosure rails that never touch: a consented commercial disclosure the person can refuse, or a dispute that ends in due process. Why a relying party wants identity determines whether consent can even be asked, and that question is what splits the two rails.
A relying party that wants a relationship (an account, a subscription, compliance for its own books) can make an offer: a priced disclosure bid, paid to the principal, resolved by the principal’s own policy or a live prompt to the human. Refusal is free, safe and the default. The lawful basis is the person’s explicit consent, never the payment. Built, switched off and fail-closed on both sides; activation waits for counsel.
When something went wrong, you cannot ask the subject — a defrauder would always refuse. In the design specified and scheduled for the financial-recourse stage, disputes run on escrow, bonds and due process: paid first with no identity, escalated to a minimal fraud signal, unmasked in full only when an arbiter certifies a court case is warranted. The subject cannot veto it, and no one can buy it.
The two rails are separated by construction. A refusal on the commercial rail can never escalate into a dispute, and an unmasking can never be dressed up as a consented offer. Each disclosure leaves a committed receipt on-chain, never its content.
Even a paid reveal identifies one agent at one moment. It gives no right to recognise, re-contact or track the principal afterwards; a counterparty that wants to know again later pays again. Pairwise pseudonyms live only as long as the credential and change on renewal, which is how the privacy guarantee works. Identification, not surveillance.
Four properties, each one provable in zero knowledge and none of them a tracking handle: the scope the person set, how the agent’s key is held, the operator context and the revocation guarantee.
An agent’s delegated scope is structured: what it may do, with whom, in which categories and places, when, and up to what value. It is signed at mint, so the agent cannot widen it, and each part is provable on its own — a merchant can learn “authorised for this category, under this limit” and nothing more. The axes are specified; bounded agents are minted today with a preset scope, and the verifier-side delegation checks arrive in the next waves.
The issuer attests how the agent’s keys are held, and the agent can prove it meets a custody requirement without exposing a correlatable identifier. A managed runtime is a signal to weigh, never a root of trust.
An optional attested attribute describes who operates the agent, separately from which agent it is. Two agents of the same principal stay unlinkable, always.
Issuer-side revocation enters the next status root (≤ 30 s) and is refused by every verifier within the maximum root age — under a minute at the reference values — or at once through the emergency key. The chain enforces status freshness as a consensus rule, and no verifier accepts a status root older than the maximum root age: 45 seconds at the reference values, 180 seconds on the single-node production chain. An optional push channel can announce revocations sooner, but it carries no security weight: the status root is the truth.
Agents run for months with no human reachable. In the design of the consented commercial disclosure rail, the principal can pre-delegate a bounded consent authority, with a ceiling cut along identifiability: a pairwise pseudonym is fully delegable; a single contact attribute only to a named allowlist, with caps and an expiry; full KYC never — that always takes a live human, or the answer is no. A price can be a condition for consent, but never a substitute for it.
The agent credential profile and issuer-side minting run today on the single-node production chain, in production since 20 September 2026 and operated by the CONECTIA group. Each agent credential is derived from a presentation of its principal’s credential, under a per-person cap, an issuance rate limit and a renewable lease, and the buyer-side transport for payment flows runs there too. Bounded agents are minted today from a bundle catalogue the operator supplies. The person or the operator can switch a credential or an agent off without asking the issuer, in production since 24 September 2026. The consented commercial disclosure rail, contact-attribute identification included, is built and ships switched off and fail-closed; its activation waits for counsel. Disclosure to a nominated, legally obligated counterparty is specified and under construction on the disclosure rail; its activation depends on a counsel item. The next waves bring the verifier-side delegation checks, which make the counterparty proven rather than declared, and the self-service verifier tier. Money before identity, the financial layer, is specified and scheduled as the next layer (2027 window); audits not started; no funds are locked today. Each audit in the programme is a scheduled milestone whose findings are published. The CONECTIA group operates the chain, the first accepted issuer and verifier, and ZadQ, the first product built on MintID; it is a disclosed related party of MintID, and nothing measured there is independent adoption.
MintID’s agent credentials compose with the emerging agent-identity and agentic-payment rails, so human-backed identity can sit inside agent-to-agent (A2A) and Model Context Protocol (MCP) workflows.
By April 2026 the major payment networks had shipped or announced know-your-agent features that restore accountability by revealing the principal’s identity to the seller. MintID leaves that mass, lower-assurance segment to them and builds for a narrower one: backing that is private, regulated-grade and, from the financial-recourse stage, funded.
For agent payments, MintID integrates as a transport profile and leaves the payment protocol unchanged. On x402, the pay-per-request protocol built on HTTP’s 402 status code, a seller’s payment-required response can state an identity requirement; the buying agent answers a short-lived challenge from the payment facilitator, which acts as the registered verifier, and presents alongside its payment. The profile defines three levels: payment only; Web Bot Auth, for identified software; and Web Bot Auth plus MintID, for identified software with an accountable human behind it. ZadQ, the first product built on MintID, an x402 seller-verification service operated by the CONECTIA group, a disclosed related party, applies the idea to sellers on the classical seller rail; the zero-knowledge seller rail follows. Read about ZadQ
More questions — on assurance grades, key recovery or what the chain stores? Read the full FAQ. New to the concept? Start with the guide to what the market calls know your agent
Each of your agents can carry its own credential, backed by one verification of you and private by design; the design draws on the OpenID Foundation’s work on identity for agentic AI. See how the protocol defines it, or talk to us about building on it.