dobi.guru
prowl.worldProwl dropped its signup form — the signature is the account
Visit the agent directory Auth for AI agents, humans,
and whatever comes next
Verify your identity once and pre-authorize the services your agents use. They sign up and sign in with a verifiable credential — no forms, no shared passwords, no OAuth dance.
Non-custodial — you sign locally Offline-verifiable Revocable
Notlogin is an easy to implement, adaptable auth broker for AI agents
SECURITY BUILT-IN
<1 ms
offline Ed25519 signature verification — no callback to us needed
MADE FOR DEVELOPERS
5 lines
of SDK for a vendor to accept verified agents
REVOCATION-FIRST
1 call
invalidates every copy of a credential, instantly
Built for what you're building
Secure your AI agents
Verify the human
Secure the person behind the agent first: email, phone, wallet or full KYC, signed once by Notlogin.
Scope the credential
Choose which vendors your agent can use on your behalf, which proofs it carries, and when it expires.
Cap the spend
A USDC budget travels inside the credential — the blast radius of a compromised agent is measured in dollars.
Featured capabilities
Verifiable credentialsProof tiersUSDC budgetsInstant revocation
I need a temp inbox for this projectcan you sign up for apumail?
Credential presented
Notlogin engine
Verifying Ed25519 signature and required proofs for this vendor.
const cred = await verifyCredential(vcJson, { vendorSlug: 'apumail', requiredProofs: ['email', 'wallet'], });
Signature verified
Account created
Done — your inbox is ready.
No form, no password, verified-human tier.
Make your service agent-ready
Build with the SDK
Five lines of TypeScript verify any credential offline against our published keys. No API keys to manage on your side.
Set your proof bar
Declare the proofs you require — email for a mailer, email+sms+wallet+kyc for a bank. The credential shows what the human passed.
Meter the spend
Each credential carries a USDC budget. Record redemptions against the broker ledger and stay settlement-ready.
Featured capabilities
Five-line verificationProof barsCatalog listingAgentic test suite
Verified credential active
Holder
oscar@example.com · human verified
email sms wallet kyc
USDC BUDGET$15.50 / $25.00
sig ed25519:9f3a…c41dexp 30d
More signups. Zero bot noise.
Verified-human tiers
Every agent account traces back to an accountable, verified person — welcome agent traffic instead of blocking it.
Passwordless by default
Humans sign in with a magic link or Google; agents with a signed credential. Nobody types a password.
Sign in with Notlogin
A standard OIDC button for your web app too — one identity for the human and every agent acting for them.
Featured capabilities
Proof levelsMagic linksOIDC + PKCEAgent budgets
Email proof
SMS proof
Wallet co-sign
Full KYC
Developers
Integrate Notlogin in any stack in 5 minutes
One TypeScript SDK for vendors, plain HTTPS for agents, standard OIDC for humans. Keys are published at /.well-known — verification runs offline in your process, so there's nothing to configure and nothing to rotate.
-
npm i notlogin-sdk— verify credentials in five lines - Agents need zero SDK — one GET to /auth.md, one POST with the credential
- “Continue with Notlogin” button — standard OIDC + PKCE
import { verifyCredential } from 'notlogin-sdk'
// The handler an agent calls to sign up:
const cred = await verifyCredential(req.body.vcJson, {
vendorSlug: 'your-app',
requiredProofs: ['email', 'wallet'],
})
if (cred.valid) {
// verified-human tier — no signup UI
return grantApiKey({ tier: 'verified-human' })
}Workflow
How it works
Three steps from human verification to autonomous agent access.
01
Identityoscar@example.com
Email verified
Phone verified
Wallet 0x8f…c41d signed
Full KYCoptional
Verify your identity once
Confirm email, phone, Google, an EVM wallet or full KYC. Notlogin signs the transcript — your agents never see your password.
02
Authorize vendor1 of 1
apumail · email for agents selected
Expiry30 days
USDC BUDGET$25.00
Pre-authorize vendors
Pick vendors or whole categories. Set a USDC budget, scope and expiry, then issue a Notlogin-signed credential in one click.
03
Agent sessionlive
Credential presented
Signature verified
Verified-human tier
0 FORMS · 0 PASSWORDS · <1 MS
Agents sign in everywhere
Your agent presents the credential to any vendor. The SDK verifies the signature offline and grants a verified-human tier — no UI, no signup.
The problem
Every workaround hands your agent a secret
Passwords, API keys and OAuth tokens were designed for humans and servers — not for autonomous agents holding them inside a prompt.
Sharing your password
Full account takeover if the agent leaks it. Breaks every terms of service. Revoking means changing your password everywhere.
Handing out API keys
A standing secret sitting in the agent’s context — one prompt injection away from exfiltration, with no scope and no spend limit.
OAuth consent flows
Built for humans at a consent screen. Agents can’t click “Allow”, and the token that comes out still lives inside the agent.
THE BROKER MODEL
Notlogin: credentials, not secrets
- Agents carry a scoped credential, never a secret of yours
- Ed25519-signed, verified offline in under a millisecond
- USDC budget caps the blast radius in dollars
- One revocation call kills every copy instantly
- Vendors see which proofs you passed — email, SMS, wallet, KYC
Machine-readable
Send your agent to /auth.md
Notlogin speaks agent-native. The full auth contract — what the credential is, how to obtain it, how to present it, what every error means — lives in plain markdown at notlogin.com/auth.md, with a site overview at /llms.txt. No docs to scrape, no SDK required on the agent side.
- Agents discover the contract themselves — one GET, zero HTML parsing
- Follows the auth.md convention agents already check for
- The credential is the auth — nothing to store, nothing to leak
agent-shell
$ curl -s https://notlogin.com/auth.md
# Notlogin — how agents authenticate here
credential : Ed25519-signed JSON (vcJson), issued by
your human at notlogin.com
present : send vcJson to any vendor that accepts
Notlogin — account created, no form
verify : vendors check the signature offline
against /.well-known public keys
revocation : your human can kill it with one callPlatform
Built for trust, not forms
A credential the user controls, a bar the vendor sets, a signature anyone can verify.
Verifiable credentials
Ed25519-signed by Notlogin over a canonical payload. Vendors verify against public keys at /.well-known — fully offline, sub-millisecond.
Per-vendor proof bars
Each vendor declares requiredProofs. A mailer takes email; a bank takes email+sms+wallet+kyc. One credential, the vendor picks the bar.
Wallet co-sign + on-chain anchor
Optionally add a user-wallet EIP-712 signature and anchor the cert hash on Base for independent, tamper-proof verification.
USDC budgets via x402
Every credential carries a spend budget. Vendors meter usage against it through the broker ledger — settlement-ready.
Revocation-first
Bearer credentials with a stable nonce. Revoke instantly; vendors in online mode check the broker on every redemption.
Five-line SDK
Drop notlogin-sdk into any TypeScript backend. No API keys on the vendor side — the signature is the auth.
In production
You’re in great company
The first agent-native products use Notlogin as the trust layer between their users and the software their agents touch.
apumail.com“Our inboxes are issued to agents, not humans. The SDK verifies credentials offline from day one: no API keys to rotate, nothing for a prompt injection to steal.”
Apumail team
Email for agents · apumail.com
YOUR PRODUCT HERE
Building something agents should be able to use? Get listed in the catalog and start accepting verified agents this week.
Resources
Read. Verify. Ship.
Deep dives on agent identity, verifiable credentials and the auth broker model — from the team building Notlogin.
More on the Notlogin blog — a new guide ships every week.
FAQ
AI agent authentication, answered
The questions every team shipping agents ends up asking about agent identity, signup and credentials.
What is an auth broker for AI agents?
An auth broker sits between AI agents and the services they use. The human verifies their identity once and pre-authorizes vendors; the broker issues a signed, scoped credential the agent presents instead of a password or API key. Vendors verify the signature and know a real, accountable human stands behind the agent.
How do AI agents sign up for services without a form?
The agent presents a Notlogin verifiable credential to the vendor. The vendor’s backend verifies the Ed25519 signature offline with the notlogin-sdk and creates the account at a verified-human tier — no signup form, no email confirmation loop, no OAuth consent screen. Machine-readable instructions live at notlogin.com/auth.md.
Is it safe to give AI agents my passwords or API keys?
No. Any secret inside an agent’s context is one prompt injection away from leaking, and a raw password grants standing, account-wide access. With Notlogin, agents never hold secrets: they carry a scoped, budget-capped, revocable credential, and your passwords never leave you.
How do vendors verify a Notlogin credential?
With a five-line SDK call: verifyCredential() checks the Ed25519 signature against Notlogin’s public keys published at /.well-known — fully offline, sub-millisecond. Vendors declare which proofs they require (email, SMS, wallet, KYC) and the credential shows which the user passed.
Can I revoke an agent’s access?
Instantly. Every credential carries a stable nonce; one revocation call invalidates all copies. Credentials also expire by default and carry a USDC spend budget, so the worst case of a compromised agent is capped in advance.