ISSUE
Mint the passport
Create a reusable agent identity tied to the principal, wallet, scope, and runtime.
Agent passport
Give your agent an identity merchants can trust.
Limits it cannot rewrite. A kill switch you control. Free, no account, 60 seconds.
An Agent Passport is how your agent proves who sent it and what it is allowed to do, and how you shut it down if it is hijacked.
Identity versus mandate
The passport has two parts. Who your agent is (signed once, never changes) and what it may do (rules you can change or revoke anytime).
The passport signs identity, not spend. The mandate, what it may do and how much it may spend, is a set of rules you can update anytime without re-issuing or re-signing.
signed twice, with a classical and a post-quantum key, so the record stays provable for decades
The 60-second way
Copy one prompt and your agent does the rest.
Paste this into Claude, ChatGPT, Cursor, or any assistant that can use tools. It will connect to FLINT and mint your agent's passport, then hand you a link to claim it.
Prompt
Connect to the FLINT MCP server at https://flint.network/mcp (free, no account). Use the issue_agent_passport tool to mint a passport for my agent. Ask me for the agent's name, what it is allowed to do, and its maximum transaction amount, then set that as the mandate. When done, give me the public passport URL and the claim link so I can take ownership and turn on the kill switch.
No assistant handy? Use the form below, 3 fields, same result.
Path 2 / Web form
Issue a passport in the browser.
Ready to issue
What happens next
Ready to issue
Submit the form to call FLINT Network and mint a public passport URL for this agent.
A public verifiable URL for your agent
A signed identity that never changes
A mandate you can edit or revoke anytime
Sentinel takeover alerts and freeze, free
How the passport works
VERIFY
Check each action
Ask FLINT whether this agent can take this action, in this context, right now.
PROVE
Return signed evidence
Send merchants a tamper-resistant verification record they can store with the transaction.
FLINT works where agents work
MCP connectorflint.network/mcp
Claude connectorClaude.ai, Claude Code, and Cowork
x402 Bazaar listingVerification endpoint listed
For engineers: API, SPIFFE, and response shapes
POST /api/passport request
This is the exact body the page sends to the issuance endpoint.
{
"agent": {
"agent_name": "Invoice Bot",
"controller_id": "org_acme",
"controller_type": "organization",
"wallet_address": "0x7f4a3e8b9d2c5f1a0b4e7d3c6f9e2a8b1d4c7f3c1"
},
"mandate": {
"allowed_actions": [
"commerce_purchase",
"x402_verification_purchase",
"invoice.pay"
],
"max_transaction_amount": 900,
"notes": "May pay approved invoices and complete checkout within mandate."
},
"origin": "web",
"src": "passport"
}Response shape
The endpoint returns a signed envelope, mutable mandate config, and verification summary.
{
"passport_id": "kya_01J...",
"flint_agent_id": "faid_...",
"passport": {
"envelope_version": "hybrid-v0",
"jws": "eyJhbGciOiJFUzI1NiIsImtpZCI6ImZsaW50LXByb2QtMjAyNi1RMiJ9...",
"pq_signature": "base64url_ml_dsa_65_signature",
"pq_kid": "flint-pq-2026-Q2",
"pq_alg": "ML-DSA-65"
},
"identity": {
"record_type": "agent_passport",
"record_version": "1.0",
"status": "stamped",
"agent_name": "Invoice Bot",
"controller_id": "org_acme",
"wallet_address": "0x7f4a..."
},
"mandate": {
"allowed_actions": [
"commerce_purchase",
"x402_verification_purchase",
"invoice.pay"
],
"max_transaction_amount": 900,
"version": 1
},
"verification": {
"signature_valid": true,
"es256": true,
"pq": true,
"valid": true
},
"graph_seeded": true
}FLINT MCP tool
Use issue_agent_passport from flint.network/mcp.
{
"tool": "issue_agent_passport",
"server": "https://flint.network/mcp",
"arguments": {
"agent": {
"agent_name": "Invoice Bot",
"controller_id": "org_acme",
"controller_type": "organization",
"wallet_address": "0x7f4a3e8b9d2c5f1a0b4e7d3c6f9e2a8b1d4c7f3c1"
},
"mandate": {
"allowed_actions": [
"commerce_purchase",
"x402_verification_purchase",
"invoice.pay"
],
"max_transaction_amount": 900,
"notes": "May pay approved invoices and complete checkout within mandate."
}
}
}Signed identity
Identity is hybrid-signed once. The mandate is not inside this signature.
{
"record_type": "agent_passport",
"record_version": "1.0",
"status": "stamped",
"agent_name": "Invoice Bot",
"controller_id": "org_acme",
"wallet_address": "0x7f4a..."
}Mutable mandate
Mutable config read at decision time. Updating it does not re-sign the passport.
{
"allowed_actions": [
"commerce_purchase",
"x402_verification_purchase",
"invoice.pay"
],
"max_transaction_amount": 900,
"version": 1
}Passport envelope
Portable hybrid envelope: ES256 compact JWS plus ML-DSA-65 signature.
{
"envelope_version": "hybrid-v0",
"jws": "eyJhbGciOiJFUzI1NiIsImtpZCI6ImZsaW50LXByb2QtMjAyNi1RMiJ9...",
"pq_signature": "base64url_ml_dsa_65_signature",
"pq_kid": "flint-pq-2026-Q2",
"pq_alg": "ML-DSA-65"
}Verification summary
{
"signature_valid": true,
"es256": true,
"pq": true,
"valid": true
}POST-QUANTUM READY
ES256 + ML-DSA-65 verifiedEvery record is signed twice.
A classical ES256 signature and a post-quantum ML-DSA-65 signature, the NIST-standard lattice scheme, cover every FLINT passport. The proof you keep today stays verifiable even after quantum computers can break classical signatures.
The ES256 compact JWS remains inside the portable hybrid envelope. The post-quantum ML-DSA-65 signature travels beside it, over the same canonical payload.
Attach to your agent
Call FLINT again when the agent tries to spend.
Minting is step one. At spend time, send the passport_id, nonce, timestamp, transaction.amount_display, and an environment signal so FLINT can apply the current mandate before money moves.
/api/verify server snippet
Recommended server path. Send the passport_id with the transaction and the signal you trust for this agent.
const response = await fetch("https://flint.network/api/verify", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
nonce: crypto.randomUUID(),
timestamp: new Date().toISOString(),
passport_id: "kya_01J...",
partner_id: "merchant_checkout",
merchant_reference: "order_847",
transaction: {
amount_display: "847.00",
currency: "USDC",
merchant_reference: "order_847"
},
agent_claim: {
agent_id: "kya_01J..."
}
})
});
const verificationRecord = await response.json();MCP config
Keep the passport_id available to your agent runtime so tools can verify the current mandate at spend time.
{
"mcpServers": {
"flint": {
"url": "https://flint.network/mcp",
"metadata": {
"passport_id": "kya_01J..."
}
}
}
}SPIFFE claim
Use the agent's workload identity when your runtime already issues SPIFFE SVIDs.
const response = await fetch("https://flint.network/api/verify", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
nonce: crypto.randomUUID(),
timestamp: new Date().toISOString(),
passport_id: "kya_01J...",
partner_id: "merchant_checkout",
merchant_reference: "order_847",
transaction: {
amount_display: "847.00",
currency: "USDC",
merchant_reference: "order_847"
},
agent_claim: {
spiffe_svid: "spiffe://acme.example/ns/agents/sa/invoice-bot"
}
})
});
const verificationRecord = await response.json();