Open source · Apache 2.0 Trusted agents for a more open web

Give every AI agent an identity it can prove.

HelixID gives agents cryptographic identity, scoped authority, and an auditable trust chain, so they can work across organizations without sharing API keys.

Get started free View the docs

Prefer to self-host? No ledger required →

Open standards Developer friendly Built for the agent era

Step 1: The Problem

AI agents aren't users.

So why are we authenticating them like users?
- Who is the agent?
- What is it allowed to do?
- Who authorized this action?
Step 2: The Passport

Give the agent a passport.

A cryptographic identity issued by your organization, defining what the agent can ever do.
Step 3: The Visa

But a passport isn't permission to enter.

Each service issues its own grant after user consent, defining what the user actually allows.

At the Border

Verify before the tool runs.

The service verifies both credentials locally, no callback, no custom integration and allows only what's permitted.

At the Border

Five checks, in milliseconds.

The service verifies the agent's passport and visa at the execution boundary, checking signatures, validity, revocation, target, delegation and allows only what's permitted.

Valid signatures
Not revoked (status list)
Correct target service
Within scope
Valid delegation chain

Result: ALLOW

Verified in milliseconds at the boundary.

No Call Home

Verify locally. No custom integration.

Services can verify HelixID credentials without calling back to us. No API keys. No bilateral setup. Just standards, tokens and public keys.

Offline verification (using cached keys and status lists)
No callback. No shared secrets.
Works across organizations, out of the box.
Still verifies months later, even to parties the issuer never met
Low latency

The Trust Stack

Identity is just layer one. True trust is a stack.

HelixID provides a complete trust stack from identity and scoped permissions to enforcement, audit trails, and revocation so you can safely give agents real access in the real world.

Can we stop it? StatusList

Revoke credentials without affecting other access.
What actually happened? Audit

A tamper-evident audit trail of every decision.
Can it do it here? OPA / Rego

Policy-based enforcement at the service.
What is it allowed to do? Grants

Scoped, limited, time-bound permissions.
Who is this? DID + VC

A verifiable identity issued by your organization.

Most “agent auth” stops at layer one or two. HelixID ships the full stack.

Explore the trust stack →

A Complete Audit Trail

Every action leaves evidence.

HelixID creates a tamper-evident record of every step, from credential issuance and consent to verification and tool execution. Successes and denials are both audited, so you always know what happened, when, and why. The record travels across organizations and can optionally be anchored to a public ledger (Hedera) for independent proof.

See the audit events →

Delegation

Agents can delegate without losing trust.

An agent can issue scoped permissions to a sub-agent or a tool, and the full chain of trust is preserved. Every step is cryptographically verifiable, so you always know who authorized what.

Delegate specific tasks, not full access
Maintain a verifiable chain of authority
Chain across many hops, narrowing scope at each
Revoke a sub-agent without touching the parent

See delegation in the docs →

See it work

See an agent cross a trust boundary.

In just 10 minutes, run through the complete flow, from identity to user consent, to verification, to tool execution, to an audit record.

Run the 10-minute demo → Or try the 5-minute quick start →

$ helixid demo
✓ Agent identified: acme-refund-bot
✓ Requesting user consent at shipco.com
✓ User approved: refunds:issue ≤ $50
✓ Delegated grant issued (VC)

✓ Presenting credentials to shipco.com
✓ Signature: valid (Ed25519)
✓ Status list: not revoked
✓ Verification: valid (1.2 ms)

✓ Policy: refunds:issue ≤ $50
✓ Calling tool: issue_refund(amount: 42)
✓ Result: success

✓ Audit record created: 8af3…e21c
✓ Anchor: hedera 0.0.4487123
✓ Queryable via /audit/8af3…e21c

Built on open standards

Standards you know. For the agent era.

HelixID is built on open, widely adopted standards, so it works with your existing infrastructure and ecosystem. OAuth gave your agent a building pass; HelixID gives it a passport. We don't replace OAuth, we complete it: exchange a presentation for an OAuth token (RFC 8693) and keep your existing infrastructure.

W3C Verifiable Credentials (VC)
Decentralized Identifiers (DID)
OAuth, OIDC and token exchange (where appropriate)
MCP, LangChain / LangGraph and CrewAI
Okta, Entra and Auth0 (launching soon)
Policy-based enforcement (e.g. OPA/Rego)

View all supported standards →

Built for regulated industries

For agents that touch money and medical records.

In finance and healthcare, "the agent did it" won't satisfy an auditor. HelixID ties every agent action to the person who approved it, the limits that applied, and a record that proves both.

Financial services

Acme's payables agent pays a vendor invoice through a partner bank's payments API.

Acme issues the passport: payments up to $10,000. The bank issues the visa after Acme's finance lead approves it: payments up to $2,500, to approved vendors only. The agent can never move more than the smaller of the two.

Passport + visabank.example

agent: acme-payables-bot
scope: payments:initiate ≤ $2,500
approved by: finance@acme.com

$1,800 to Vendor AALLOW
$4,000 to Vendor BDENY · over limit

both decisions written to the audit trail

Spending limits checked at the payments API, before money moves
Every payment traced back to the person who approved it
Revoke one agent's authority without rotating shared API keys
Aligned with AP2 mandates for agent-initiated payments

Healthcare

A clinic's scheduling agent needs a patient's lab results from an outside lab to book a follow-up.

The clinic issues the passport: the agent may read records for the clinic's own patients. The lab issues the visa after the patient consents: one patient's results, valid for 7 days. Once the follow-up is booked, the access ends on its own.

Passport + visalab.example

agent: clinic-scheduler-bot
scope: results:read · patient #4821
consent: signed by patient
expires: 7 days

Read lab resultsALLOW
Read full historyDENY · out of scope

both decisions written to the audit trail

Access scoped to one patient and one purpose, not the whole database
Patient consent captured as a signed credential, not a line in someone's logs
Access expires automatically when the task window closes
Every read, and every denied attempt, recorded with who authorized it

What your compliance team gets

Who: A verifiable identity for every agent, tied to the organization that owns it
On whose authority: A signed chain from the approving person to the action
Within what limits: Scopes checked at the service, before data or money moves
What happened: A tamper-evident trail of approvals and denials, optionally anchored to Hedera
How to stop it: Revoke one agent without touching anything else

Talk to us about regulated deployments

Private and VPC deployment available. Your keys and audit data stay in your infrastructure.

For developers

Verify at the boundary in a few lines.

Drop the SDK or @helixid/mcp-middleware into any service. Check the agent's signed presentation and enforce the one scope the action needs — no callback to the issuer required.

verify.ts

import { HelixClient, verifyVP, requireScope } from "@helixid/sdk-js";

const client = new HelixClient(process.env.HELIX_API_URL);

// check the agent's signed presentation
const result = await verifyVP(presentation, client, {
  expectedTargetService: "orders",
});

// enforce the one scope this action needs
requireScope(result, "orders:read"); // throws if not granted
// proceed with result.agentDid

import os

from helix_sdk import HelixClient, verify_vp, require_scope

client = HelixClient(base_url=os.environ["HELIX_API_URL"])

# check the agent's signed presentation
result = verify_vp(presentation, client, expected_target_service="orders")

# enforce the one scope this action needs
require_scope(result, "orders:read")  # raises if not granted
# proceed with result["agentDid"]

Python SDK launching soon.

JavaScript / TypeScript MCP middleware Python · launching soon

Read the docs

Pricing

Open core. Start free, scale to compliance.

Open Source

Apache 2.0 · self-hosted

Full SDK, DIDs & VCs
VP verifier
Basic OPA policy
did:key local mode
Local audit log

Star on GitHub

Hosted

$0 to start

Managed by HelixID

Onboard 1 agent
Managed API & Console
Hosted did:web issuer DID
Encrypted issuer keypair
Email or Google sign-in
Same open stack, zero setup

Start free

Enterprise

Custom

For compliance-grade rollouts

Private / VPC deploy
SSO / SAML / RBAC
Compliance audit vault
AP2-aligned fintech compliance
Dedicated SLA + support

Book a demo

Building for cross-org compliance — multi-hop delegation, compliance auditing, or a design-partner engagement? Talk to sales →

Give your agents an identity they can prove.

Run it yourself, or let us host it. Same open stack either way, no vendor lock-in, Apache 2.0, no AGPL friction.

Get started free Book a demo Read the docs

Give every AI agent an identity it can prove.

How HelixID works

AI agents aren't users.

Give the agent a passport.

But a passport isn't permission to enter.