Agent Self-Signup

With the CLI

1. 1

   Get a DID (once)

   terminal

   Copy

   npx openentity adopt --name research-bot --agree
   # prints your DID: did:key:z6Mk...

2. 2

   Sign up

   ass register asks for a challenge, signs it with your DID key and creates the vault. Needs CLI 1.1 or later.

   terminal

   Copy

   ass register --eid did:key:z6Mk... --name research-bot
   export ASS_AGENT_KEY="ass_..."   # printed once

3. 3

   Send your owner the claim link

   The command prints a claim URL. Send it to whoever runs you. They sign in, and the vault joins their account. Your key keeps working.

With the REST API

No auth header: the signed Presentation is the credential.

curl -X POST https://api.agentsecretstore.com/v1/agents/self-register/challenge \
  -H "Content-Type: application/json" \
  -d '{"eid": "did:key:z6Mk..."}'
# {"eid": "did:key:z6Mk...", "nonce": "...", "audience": "https://api.agentsecretstore.com", "expires_at": "..."}

npx openentity present --audience https://api.agentsecretstore.com \
  --nonce <nonce> --no-attestations --json > presentation.json

curl -X POST https://api.agentsecretstore.com/v1/agents/self-register \
  -H "Content-Type: application/json" \
  -d "{\"presentation\": $(cat presentation.json), \"name\": \"research-bot\"}"

{
  "agent_id": "…",
  "tenant_id": "…",
  "eid": "did:key:z6Mk...",
  "api_key": "ass_…",
  "plan": "unclaimed",
  "max_agents": 1,
  "max_secrets": 10,
  "max_token_requests_month": 1000,
  "expires_at": "2026-11-25T…",
  "claim_code": "ABCD-EFGH-JKLM",
  "claim_url": "https://agentsecretstore.com/claim?code=ABCD-EFGH-JKLM"
}

Then use the vault like any agent: request a scoped token with the key and read or write secrets. See Getting Started.

Unclaimed vault limits

Claiming

• The owner opens the claim URL, signs in or creates an account, and confirms the code.
• No vault yet: the agent's vault becomes theirs, on the Free plan.
• A vault already: the agent and its secrets move into it, re-encrypted under the owner's key. Old tokens are revoked; the agent key keeps working. If a secret path already exists in the owner's vault, the claim stops with 409 and names the paths.

Edge cases

• Lost key or claim code: sign up again with the same DID. You get a new key and claim code for the same vault; the old key stops working.
• Already claimed: a DID whose vault has an owner cannot self-register again (409 EID_ALREADY_CLAIMED). Ask the owner for a key.
• Expired: after 30 days unclaimed, the API answers 410 VAULT_EXPIRED and the vault is deleted. Sign up again to start over.
• Rate limit: 5 sign-ups an hour per IP address.