about-us.md

the handshake

Signed intent.
Verifiable in one round-trip.

Every request from a verified customer (human or agent-acting-for-human) arrives as a signed envelope. You resolve their key, check the scope, and act. The whole exchange fits in one HTTP round-trip and it's cryptographic — not "we hope they clicked the box in 2022."

Five steps, one round-trip

  1. 1

    Intent is composed and signed

    The customer's client (browser, mobile app, or delegated agent) builds an intent envelope {from, intent, scope, expires, nonce} and signs it with an ed25519 key rooted at /u/<handle>. Delegated agents sign with a scoped subkey.

  2. 2

    Envelope hits your endpoint

    Any surface you already run: support inbox, refund API, agent gateway. The envelope is a JSON blob in the body or the X-Handle-Intent header — you pick.

  3. 3

    You resolve the handle's keys

    Fetch https://username.md/u/<handle>/.well-known/keys. Cache the JWKS response for its TTL (default 60s). No new SDK — plain HTTP+JSON.

  4. 4

    Verify signature + scope + expiry

    Standard ed25519 verify. Check scope against what the intent actually asks for. Check expires against now. Reject on mismatch.

  5. 5

    Act — and log the receipt

    Store the signed envelope with the resulting action. That envelope is your consent receipt: replayable, non-repudiable, revocable. Refund disputes get shorter.

The envelope, up close

from: /u/aclay intent: refund.request order: HC-orders-2026-04812 via: /u/aclay/agents/claude-shopping scope: read:orders, write:refunds(self) issued: 2026-06-28T14:02:11Z expires: 2026-06-28T15:02:11Z nonce: 01HXR7Z1M6...4V sig: ed25519:7af3…c01b

Everything is public-key verifiable. The customer never gives you their private key; you never store one. The scope is bounded. The expiry is short. The nonce prevents replay.

Where the verification runs

Option A

Edge middleware

10-line Node/Go/Python middleware in front of your API. Rejects invalid envelopes before they touch business logic.

Option B

API gateway plugin

Kong, Envoy, or Traefik plugin. Verifies once, forwards a trusted X-Verified-Handle header to your services.

Option C

Helpdesk hook

Zendesk/Freshdesk/FreeScout inbound webhook. Tags the ticket with the verified handle and surfaces the scope to your agent.

What you don't have to build

Ready to try it?

Developer quickstart See integrations