For developers
You spent the money on GEO.
The agent found you. Now what?
AgentKeychain signs every agent request and ties it to a real OAuth owner. Welcome the agents that showed up for your users. Revoke the ones that didn’t.
The problem
Agents don’t announce themselves. They authenticate with their owner’s Google account, complete your signup flow, and call your API with a key that belongs to a real user. Everything looks normal. Your auth stack has no signal to tell them apart.
Why bot walls miss
Every bot wall on the market asks the same thing: is this a human? That race is getting harder to win. AI solves captchas, residential proxies fool fingerprinting, and even when it works, you’ve just blocked an agent your user sent.
The right question isn’t human or bot. It’s is there a real person behind this, and can I hold them accountable?
The answer
AgentKeychain issues every agent a signed identity tied to a real OAuth owner. The agent shows up as itself — not as its user. You get an actor_type claim, an owner chain, and something to revoke.
One abuse report takes out every agent that owner controls. Spin up a new one and we know it’s the same human. Spam farm economics collapse.
How it works
AgentKeychain implements OpenID Connect. If your stack already speaks OIDC — Auth0, Clerk, NextAuth, WorkOS, plain OAuth — adding agent sign-in is a new provider entry. No SDK lock-in.
Request the scopes you need and you get a userinfo payload with both the agent and its human owner — enough to link an agent session to an existing user account in your database.
/.well-known/openid-configuration{
"sub": "agent_7f3b9c8d2e1f0a5b",
"agent_name": "OpenClaw",
"actor_type": "agent",
"owner": {
"sub": "user_e14a0b92",
"email": "maddy@limehouse.io",
"email_verified": true,
"name": "Maddy Nakada",
"oauth_provider": "google"
},
"scopes": ["openid", "profile", "owner:email"],
"issued_at": "2026-04-14T18:22:03Z"
}For high-trust surfaces
OAuth is enough for most products. For fintech, marketplaces, and regulated APIs where it isn’t, AgentKeychain layers Persona-grade human verification on any owner — ID document, liveness check, the full KYC stack. Same OIDC flow, one extra claim.
Quickstart
If you already have an OIDC-capable auth stack, this is a config change, not a rewrite.
Create a client in the AgentKeychain dashboard. You get a client_id, client_secret, and a redirect URI allowlist — same as any OIDC provider.
Point your auth library at https://agentkeychain.com/.well-known/openid-configuration. Request openid, profile, and whichever owner:* scopes you need.
Read actor_type and owner from the userinfo payload. Link agent sessions to existing human accounts, and gate the routes that need a human on the other end.
Start building
Free during early access. No credit card. Production-ready OIDC endpoints from day one.