The Identity Layer for AI Agents
97% of breached organizations lacked proper AI access controls.↗ Give your agents cryptographic identity. Scope access. Revoke instantly.
Get notified when this launches:
Issue → Scope → Verify → Revoke. All in milliseconds.
The problem with API keys
Current state: AI Agent gets a raw API key
Problems:
- What if the agent gets prompt-injected and deletes your repo?
- How does GitHub know the agent is acting on YOUR behalf?
- How do you kill JUST that agent without rotating all API keys?
API keys are for trusted servers.
They're terrible for autonomous LLMs.API Keys
Agent Credentials
Shared across all agents
Per-agent credentials
No delegation chain
Cryptographic delegation proof
Can't revoke one agent
Instant per-agent revocation
No audit trail
Full authorization history
All-or-nothing access
Scoped permissions
Issue, verify, revoke
API Preview — Coming Q3 2026
# Issue a credential to an employee
client = AhoSdk.issuer(api_key: ENV["AHO_API_KEY"])
credential = client.credentials.create(
body: {
schema_id: "AgentCredential",
subject_identifier: "did:key:z6Mk...",
claims: {
agent_id: "agent-xyz-123",
delegated_by: "[email protected]",
scope: ["read:documents", "write:messages"],
expires_at: "2026-08-06T20:28:29Z"
}
}
)# Verify agent credential
client = AhoSdk.verifier(api_key: ENV["AHO_API_KEY"])
# Request credential from agent
request = client.requests.create(
body: {
name: "Agent Verification",
purpose: "Verify agent is authorized to act"
}
)
# Check agent authorization
response = client.responses.get(
request_uuid: "req_abc123",
uuid: "resp_xyz789"
)# Agent goes rogue? Revoke instantly.
client = AhoSdk.issuer(api_key: ENV["AHO_API_KEY"])
client.credentials.revoke(
uuid: "cred_abc123",
body: {
reason: "employee_terminated"
}
)gem install aho-sdk · pip install aho-sdk · npm install @aho-sdk/core
Building the future of agent identity
We're working with standards bodies and the developer community to define how AI agents prove who they are and what they're allowed to do.
Open Standards
Built on W3C Verifiable Credentials — no vendor lock-in
Community-Driven
Contributing to DIF and collaborating with agent framework teams
Developer-First
Simple APIs today, deeper integrations as the ecosystem evolves
Use cases
Customer Service
Read-only agents, revoke on termination
Data Processing
Time-limited delegation
Multi-Agent
Hierarchical delegation chains
Third-Party
Audit who authorized what
Frequently Asked Questions
When an agent acts on your behalf, services need to know: who authorized this agent, what can it do, and how do I shut it down if something goes wrong. Verifiable credentials answer all three — with cryptographic proof, scoped permissions, and instant revocation.
Model Context Protocol Identity (MCP-I) is an open standard for agent identity that we donated to DIF (Decentralized Identity Foundation). It uses W3C Verifiable Credentials to let agents prove who authorized them and what they're allowed to do — the same credential infrastructure Aho provides.
API keys are shared secrets that give full access. Agent credentials are scoped, time-limited, and individually revocable. If one agent goes rogue, you revoke just that agent's credential — not all your API keys.
With scoped credentials, the damage is contained. A read-only agent can't delete anything. And you can revoke instantly — the agent's next request fails globally, in milliseconds.
Our API and SDKs will work with any stack. Issue credentials when spawning agents, verify them at your service boundaries. We're also working with agent framework teams on deeper integrations.
We'll support delegation chains. Agent A can delegate to Agent B with reduced scope. Full audit trail of who authorized what.
Be the first to secure your agents.
Get notified when AI Agent Credentials launches.