One API call enrolls a domain-bound AI agent with cryptographically verifiable certificates across every major agent identity standard — from durable ownership to runtime discovery, certificates, and delegation.
The problem
Agents are deployed behind arbitrary URLs with no DNS-anchored discovery record. Clients can't find them without out-of-band configuration.
Any service can claim to be your agent. There is no cryptographic proof that ties an agent to a domain and its owner.
Agents act on behalf of humans, but there is no machine-readable record of what they are authorised to do or who authorised them.
Once an agent is decommissioned or its domain moves, nothing proves who was accountable for the work it signed. TLS certs and live certificates give no answer after the fact.
Identity layers
Register a domain and enroll your agent. We provision every certificate automatically — ownership records, DNS records, X.509 certs, DID Documents, and signed VCs — and serve them from agent.{domain}.
DNS-anchored durable identity. A governance-backed ownership record that binds an accountable entity to your agent and stays verifiable long after it's decommissioned.
DNS-based agent discovery and capability advertisement. Any client can find your agent with a single DNS lookup.
GoDaddy Agent Name Service — version-bound X.509 identity with a signed Trust Card and transparency log.
Model Context Protocol Identity — a W3C DID Document and JWT Delegation Certificate for verifiable agent authorisation.
How it works
Five API calls. Everything is provisioned and served automatically — ownership records, DNS records, certificates, DID Documents, signed VCs.
Register any .kred domain. Your PowerDNS zone is created and nameservers are provisioned.
POST /agent generates an Ed25519 keypair, provisions _agent TXT + agent.{domain} CNAME, and creates the Agent Card stub.
POST /agent/dnsid binds the accountable entity to agent.{domain}, writes the signed _dnsid TXT, and opens the lifecycle log with an ISSUANCE event.
POST /agent/ans issues an X.509 identity cert, writes _ans + _ans-badge DNS records, builds and signs the Trust Card.
POST /agent/mcpi constructs the DID Document, issues a JWT Delegation Certificate with your scopes, and makes both live.
API
Every endpoint runs against your account's API base URL and requires a Bearer session token.
Registers via CentralNIC, creates the PowerDNS zone, and links ownership to your account via SocialOS domain tokens.
Generates an Ed25519 keypair (private key held server-side), provisions _agent TXT and agent.{domain} CNAME. Optional body configures the A2A Agent Card inline.
Binds an accountable entity to agent.{domain} via a signed _dnsid TXT pointer record, and opens an append-only lifecycle log with an ISSUANCE event. The record stays verifiable long after the agent is retired.
Our private RA issues an identity cert with URI:ans://v1.0.0.agent.{domain} SAN, writes _ans + _ans-badge DNS records, and builds a COSE_Sign1 Trust Card. Bump versions any time with POST /agent/ans/version.
Constructs a did:web DID Document backed by the Phase 1 Ed25519 key, then issues a platform-signed JWT Delegation Certificate with your declared scopes. Both live at well-known paths immediately.
What gets issued
All certificates are stored in our DB and served live from agent.{domain} via our proxy. No hosting required on your side.
Signed TXT pointer set binding the accountable entity to the agent FQDN. Carries entity + operational key URIs, lifecycle log reference, status URI, and the entity signature.
Append-only record of ISSUANCE, KEY_ROTATION, REVOCATION, and RETIREMENT events, each with cryptographic inclusion proofs. Verifiable after the agent is decommissioned.
Semicolon-delimited TXT record carrying endpoint URL, protocol hint, Ed25519 public key, and key ID. Used by any AID-compatible client for DNS-first discovery.
JSON document describing the agent's name, endpoint URL, capabilities, skills, and security schemes. Consumed by A2A-compatible orchestrators for task delegation.
COSE_Sign1 document (ES256, raw r||s) containing ANS identity name, version, endpoints, and verifiable claims. Signed by our private CA.
W3C DID Document anchoring the agent's Ed25519 verification key and service endpoint. Resolution requires only HTTPS — no blockchain, no registry.
W3C Verifiable Certificate in JWT format. Platform-signed with EdDSA, carrying registrant-supplied action:resource scopes in the certificateSubject.
Export the Ed25519 private key and self-hosting instructions at any time. Remove our CNAME and run your own proxy — the key material is yours.
Technical specifications
No proprietary lock-in. Every certificate format is a published open standard or IETF/W3C specification.
Register a .kred domain and enroll your agent in under five minutes.