Register a .Kred domain and run four API calls. Your agent gets cryptographically verifiable credentials across every major agent identity standard - DNS discovery, X.509 identity, a DID Document, and a signed delegation credential.
From domain registration to full credential stack - DNS records, X.509 cert, DID Document, and signed VC all provisioned automatically.
Export your Ed25519 private key and self-hosting instructions at any time. Remove our CNAME and run your own proxy - the key material is yours.
AID, A2A, ANS, did:web, JWT-VC - every format is a published spec or IETF draft. No proprietary lock-in, no vendor-specific formats.
The problem
Agents are deployed behind arbitrary URLs with no DNS-anchored discovery record. Clients can't find them without out-of-band configuration.
Any service can claim to be your agent. There is no cryptographic proof that ties an agent to a domain and its owner.
Agents act on behalf of humans, but there is no machine-readable record of what they are authorised to do or who authorised them.
Identity layers
Register a domain and enroll your agent. We provision every credential automatically - DNS records, X.509 certs, DID Documents, and signed VCs - and serve them from agent.{domain}.
DNS-based agent discovery and capability advertisement. Any client can find your agent with a single DNS lookup.
GoDaddy Agent Name Service - version-bound X.509 identity issued by our private RA, with a signed Trust Card and transparency log.
MCP-I - community extension for verifiable agent identity and delegation, built on did:web and W3C VC standards.
How it works
Four API calls. Everything is provisioned and served automatically - DNS records, certificates, DID Documents, signed VCs.
Register any .Kred domain. Your domain's PowerDNS zone is created and nameservers are provisioned.
`POST /agent` generates an Ed25519 keypair, provisions `_agent` TXT + `agent.{domain}` CNAME, and creates the Agent Card stub.
`POST /agent/ans` issues an X.509 identity cert, writes `_ans` + `_ans-badge` DNS records, builds and signs the Trust Card.
`POST /agent/mcpi` constructs the DID Document, issues a JWT Delegation Credential with your scopes, and makes both live.
API
Registers via CentralNIC, creates the PowerDNS zone, and links ownership to your account via SocialOS domain tokens.
Generates an Ed25519 keypair (private key held server-side), provisions `_agent` TXT and `agent.{domain}` CNAME. Optional body configures the A2A Agent Card inline.
Our private RA issues an identity cert with `URI:ans://v1.0.0.agent.{domain}` SAN, writes `_ans` + `_ans-badge` DNS records, and builds a COSE_Sign1 Trust Card. Bump versions any time with `POST /agent/ans/version`.
Constructs a `did:web` DID Document backed by the Phase 1 Ed25519 key, then issues a platform-signed JWT Delegation Credential with your declared scopes. Both live at well-known paths immediately.
What gets issued
All credentials are stored in our DB and served live from `agent.{domain}` via our proxy. No hosting required on your side.
Semicolon-delimited TXT record carrying endpoint URL, protocol hint, Ed25519 public key, and key ID. Used by any AID-compatible client for DNS-first discovery.
JSON document describing the agent's name, endpoint URL, capabilities, skills, and security schemes. Consumed by A2A-compatible orchestrators for task delegation.
COSE_Sign1 document (ES256, raw r||s) containing ANS identity name, version, endpoints, and verifiable claims. Signed by our private CA.
W3C DID Document anchoring the agent's Ed25519 verification key and service endpoint. Resolution requires only HTTPS - no blockchain, no registry.
W3C Verifiable Credential in JWT format. Platform-signed with EdDSA, carrying registrant-supplied `action:resource` scopes in the `credentialSubject`.
Export the Ed25519 private key and self-hosting instructions at any time. Remove our CNAME and run your own proxy - the key material is yours.
Technical specifications
No proprietary lock-in. Every credential format is a published open standard, IETF draft, or W3C specification.
Register a .Kred domain and enroll your agent in under five minutes.
AgenticID.Kred is operated by PeopleBrowsr - the team behind the .Kred top-level domain. We've operated domain infrastructure and digital identity systems since 2010.