Skip to main content

Introduction

VIA ID gives an AI agent a verifiable identity — an AgentID — and a tamper-evident record of what it did, so any party can check the agent before trusting it.

An AgentID is a small signed file: a 3-key identity (an owner key, an agent key, and a neutral VIA ID Witness co-signature) plus a hash-chained log the agent appends to as it acts. Anyone can verify a badge offline — no VIA ID server is required to check it, only to mint or co-sign a new one.

What VIA ID answers

VIA ID answers "what did this agent do, and can I trust the record?" — one narrow job, done honestly. It deliberately does not try to answer the questions other tools already answer well:

QuestionWho answers itVIA ID?
Who is this agent? (identity provider)Okta / IdPsNo
What is this agent called?Agent Name ServiceNo
Who owns this agent?GLEIF-style registriesNo
How does this agent pay?AP2No
What did this agent do, and is the record trustworthy?Yes

Claim discipline

This is the single most important thing to understand before using VIA ID, in your own code, comments, or anything you tell a user:

VIA ID says "tamper-evident" — if the log is altered, verification shows it — and never "tamper-proof," "tamper-safe," "certified," or "compliant." A verify result reports what it actually checked (signatures, log-chain integrity, key-rotation history) and an assurance tier — never a blanket claim about the agent's safety, correctness, or behavior.

See Claims & terminology for the full list of language VIA ID uses and deliberately avoids.

The three verdict states you'll see

Verifying a badge returns one of:

  • VALID — fresh, verifies clean.
  • STALE — structurally fine but past its TTL; rotate or re-attest.
  • REVOKED — the owner or an org explicitly killed it.
  • UNKNOWN — malformed or legacy; do not present as trustworthy.
  • INVALID — tampered or forged; stop and say so, never paper over it.

Where to go next