Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/vestauth/vestauth/llms.txt

Use this file to discover all available pages before exploring further.

Vestauth Hero Light

​
What is Vestauth?

Vestauth gives agents cryptographic identities and a simple way to authenticate HTTP requests. Instead of API keys, bearer tokens, or passwords, Vestauth uses public/private key cryptography built on open internet standards. Created by @motdotla, the creator of dotenv and dotenvx.
Vestauth implements RFC 9421 (HTTP Message Signatures) and the Web-Bot-Auth draft specification.

​
Key Features

Cryptographic Identity

Give agents Ed25519 key-based identities. No shared secrets, just cryptographic proof.

Built-in Tools

Call file storage, geolocation, secrets, and more with signed requests.

Simple Authentication

Verify agent requests with a single line: vestauth.tool.verify(method, url, headers)

Self-Hosting Ready

Run your own Vestauth infrastructure with PostgreSQL backend.

​
How It Works

Vestauth replaces shared secrets with cryptographic signing:
  1. Agent generates a keypair - Public and private Ed25519 keys stored in .env
  2. Agent signs HTTP requests - Private key creates unforgeable signatures
  3. Tool verifies signatures - Public key proves the request came from that agent
  4. No secrets transmitted - Only signatures are sent over the network
# Initialize an agent
vestauth agent init

# Make authenticated requests
vestauth agent curl https://api.vestauth.com/whoami --pp

​
Why Vestauth?

No Shared Secrets

Private keys never leave the agent. Public keys are safe to share.

Easy Key Rotation

Rotate keys without disrupting your agents: vestauth agent rotate

Strong Attribution

Every request is cryptographically tied to a specific agent identity.

Replay Protection

Built-in nonces, timestamps, and expiration prevent replay attacks.

Standards Based

Built on RFC 9421 and Web-Bot-Auth specifications.

Developer Friendly

Simple CLI, drop-in curl wrapper, and minimal API surface.

​
Comparison with Other Auth Methods

CapabilityVestauthAPI KeysOAuthCookies
No browser required✅✅⚠️❌
Easy to automate✅✅⚠️❌
No shared secret✅❌⚠️❌
Per-request identity proof✅❌⚠️❌
Easy key rotation✅⚠️⚠️⚠️
No secret storage (tool side)✅❌❌❌
Strong agent attribution✅⚠️⚠️❌
Stateless verification✅✅✅❌
Ready to give your agents an identity? Start with the Quickstart guide.

​
Use Cases

Vestauth isn’t just for AI agents. Use it for:
  • AI agents and autonomous systems
  • Developer tools and CLIs
  • Automation services and workflows
  • Bots and scheduled tasks
  • Infrastructure tools and monitoring

​
Standards Compliance

Vestauth builds on proven internet standards:

RFC 9421

HTTP Message Signatures - defines how requests are cryptographically signed and verified

Web-Bot-Auth Draft

Authentication architecture and headers for autonomous agents

​
Next Steps

Quickstart

Get your first agent running in 2 minutes

Installation

Install Vestauth via npm, curl, or GitHub releases

Call Tools

Learn how to use built-in and third-party tools

Build Tools

Create your own tools with simple verification

Build docs developers (and LLMs) love

Get started for freeTalk to us