Tokens · the wire format
Ed25519 · single-use · TTL-bounded.
An Authority Token is the wire format that authorizes execution. It is a JWS — header, payload, signature — that your service verifies against the tenant’s public key before your agent acts. Click any segment below to inspect its claims.
Authority Token · EdDSA · Ed25519 · issued — LOCALtyp: JWT
..
Header · the JWS algorithm + token type
contents{ "alg": "EdDSA", "typ": "JWT", "kid": "…" }
algEdDSA · Ed25519 (pure EdDSA), per-tenant key
typJWT · authority-scoped, single-use
kidminting…
Live · single-use · 5 min ttl
02 · Properties
Ed25519
tenant-scoped
single-use
replay refused at the boundary
10 min
default TTL · configurable
kid-pinned
tenant public-key verify
03 · What the verifier checks
Tenant public key
Ed25519 (EdDSA) over the header.payload signing input. Verified against the kid-pinned tenant public key; a per-tenant /.well-known/jwks.json route is live.
Not past exp
10-minute default. The verifier refuses anything past expiry. No grace window.
Matches declared action
The intent_hash claim binds the token to the specific action it was issued for.
Not in revoke list
Tokens can be revoked mid-TTL. Verifiers check the revocation registry as part of verification.