Skip to main content

Personal-agent identity

A company needs a stable way to identify the software acting for a user. The agent's HTTPS client_id points to public metadata describing its name, redirect URIs, and JWKS location. The company verifies that metadata before it accepts signed assertions; the private signing key never leaves its custodian.

What the example proves​

  • Agent metadata and JWKS are public, credential-free resources.
  • The declared identity must match the URL that was requested.
  • Redirect URIs are explicit rather than inferred from an incoming callback.
  • JWKS domain policy prevents an identity document from silently delegating trust to an unrelated key host.
  • Tool output describes policy; key coordinates and raw metadata remain outside model context.

Run the Pydantic AI example or the Agent Runtimes example. Continue with Session assertions and the personal-agent guide.