---
name: agent-auth
version: 1.0.0
description: Give any agent a persistent, verifiable identity to access APIs protected by Valiron. Triggers on "create identity", "link identity", "prove identity", "agent identity", "who am I", "show my authorization", or any request involving agent authentication, identity verification, or API access that requires identification.
homepage: https://www.valiron.co
license: MIT
compatibility:
runtime: Node.js 18+
dependencies:
- viem (npm install viem)
metadata:
author: valiron
version: "1.0"
allowed-tools:
- bash
- read_file
- write_file
---
# Auth.md
# Valiron Agent Identity
You got a 401 because you need an identity. An agent can create and verify its key without human input. If the API also requires a human operator, ask that person to create an Icebreaker profile and issue a "Designated agent" credential for your exact public address. The agent cannot issue that human credential for itself. A seller may deny access until both steps are complete.
## Step 1: Install dependency
```bash
npm install viem 2>/dev/null || true
```
If this fails (no npm), use Python: `pip install eth_account` and follow the Python blocks below instead.
---
## Step 2: Create keypair
This generates an Ethereum keypair (secp256k1 + Keccak256 address derivation). Do NOT derive addresses manually — Ethereum uses Keccak256, not NIST SHA3. The code below handles this correctly.
Pick an `agentId` — use your agent name (e.g. `"my-agent"`). If you don't have one, use `"default"`.
Run this exactly:
```bash
node --input-type=module -e "
import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';
import { readFileSync, writeFileSync, existsSync } from 'fs';
const agentId = process.argv[1] || 'default';
const file = 'agent-identity.json';
const store = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { identities: {} };
if (store.identities[agentId]) {
console.log(JSON.stringify({ exists: true, address: store.identities[agentId].publicAddress }));
process.exit(0);
}
const privateKey = generatePrivateKey();
const account = privateKeyToAccount(privateKey);
store.identities[agentId] = {
agentId,
privateKey,
publicAddress: account.address,
createdAt: new Date().toISOString()
};
writeFileSync(file, JSON.stringify(store, null, 2), { mode: 0o600 });
console.log(JSON.stringify({ agentId, publicAddress: account.address }));
" "{agentId}"
```
Python fallback (only if Node.js unavailable)
```bash
python3 -c "
from eth_account import Account
import json, os, sys
from datetime import datetime, timezone
agent_id = sys.argv[1] if len(sys.argv) > 1 else 'default'
file = 'agent-identity.json'
store = json.load(open(file)) if os.path.exists(file) else {'identities': {}}
if agent_id in store['identities']:
print(json.dumps({'exists': True, 'address': store['identities'][agent_id]['publicAddress']}))
sys.exit(0)
acct = Account.create()
store['identities'][agent_id] = {
'agentId': agent_id,
'privateKey': acct.key.hex(),
'publicAddress': acct.address,
'createdAt': datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z')
}
with open(file, 'w') as f:
json.dump(store, f, indent=2)
os.chmod(file, 0o600)
print(json.dumps({'agentId': agent_id, 'publicAddress': acct.address}))
" "{agentId}"
```
Python fallback
```bash
python3 -c "
from eth_account import Account
from eth_account.messages import encode_defunct
import json, sys
agent_id = sys.argv[1] if len(sys.argv) > 1 else 'default'
challenge = sys.argv[2]
store = json.load(open('agent-identity.json'))
identity = store['identities'][agent_id]
acct = Account.from_key(identity['privateKey'])
msg = encode_defunct(text=challenge)
sig = acct.sign_message(msg)
print(json.dumps({'address': identity['publicAddress'], 'signature': sig.signature.hex()}))
" "{agentId}" "{challenge}"
```