Skip to main content

Introduction

VIA ID gives an AI agent a verifiable identity — an AgentID — and a tamper-evident record of what it did, so any party can check the agent before trusting it.

An AgentID is a small signed file: a 3-key identity (an owner key, an agent key, and a neutral VIA ID Witness co-signature) plus a hash-chained log the agent appends to as it acts. Anyone can verify a badge offline — no VIA ID server is required to check it, only to mint or co-sign a new one.

What VIA ID answers​

VIA ID answers "what did this agent do, and can I trust the record?" — one narrow job, done honestly. It deliberately does not try to answer the questions other tools already answer well:

QuestionWho answers itVIA ID?
Who is this agent? (identity provider)Okta / IdPsNo
What is this agent called?Agent Name ServiceNo
Who owns this agent?GLEIF-style registriesNo
How does this agent pay?AP2No
What did this agent do, and is the record trustworthy?—Yes

Claim discipline​

This is the single most important thing to understand before using VIA ID, in your own code, comments, or anything you tell a user:

VIA ID says "tamper-evident" — if the log is altered, verification shows it — and never "tamper-proof," "tamper-safe," "certified," or "compliant." A verify result reports what it actually checked (signatures, log-chain integrity, key-rotation history) and an assurance tier — never a blanket claim about the agent's safety, correctness, or behavior.

See Claims & terminology for the full list of language VIA ID uses and deliberately avoids.

The five verdict states you'll see​

Verifying a badge returns one of:

  • VALID — fresh, verifies clean.
  • STALE — structurally fine but past its TTL; rotate or re-attest.
  • REVOKED — the owner or an org explicitly killed it.
  • UNKNOWN — malformed or legacy; do not present as trustworthy.
  • INVALID — tampered or forged; stop and say so, never paper over it.

Where to go next​