Home
Documentation / guide
Page: guide
⬇ Download Markdown

Agent Guide – Identity, Authentication, and Credentials

Wallet4Agent allows you to provision trusted identities and credential wallets for AI Agents — fully aligned with the EUDI Wallet architecture and eIDAS v2.

This guide complements Getting Started with Wallet4Agent and focuses on agent-to-agent flows: authentication, credential issuance, attestation discovery, and trust establishment.

All capabilities are exposed through a remote MCP Server compatible with any MCP-enabled agent framework.

1. 🔌 Connect to the MCP Server

Wallet4Agent exposes its APIs through an MCP (Model Context Protocol) server.

You can connect using the MCP Inspector:

👉 https://modelcontextprotocol.io/docs/tools/inspector

MCP endpoint

https://wallet4agent.com/mcp

2. 🧑‍💼 Create an Account and Root Identity

Create an account using:

create_account

You can choose the DID method for your root identity:

This step creates: - A root DID (Human or Company) - A base wallet that will control all future agents

3. 🔑 Authenticate as Admin (Personal Access Token)

After account creation, Wallet4Agent returns an Admin Personal Access Token (PAT).

Use it as a Bearer token:

Authorization: Bearer <ADMIN_PAT>

With the Admin PAT you can: - Create agent identities - Create and configure agent wallets - Define ecosystem and security policies

4. 🤖 Create Agent Identities and Wallets

Authenticated as your Human or Company account, create one or more agents using:

create_agent_identifier_and_wallet

Each agent has: - Its own DID (did:cheqd or did:web) - Its own wallet - Its own DID Document

For every agent you receive: - An Admin PAT (for configuration) - An Agent PAT (to act as the agent)

You should create at least two agents to test agent-to-agent authentication.

5. 🧠 Act as an Agent (Agent Wallet Access)

Authenticate using the Agent PAT:

Authorization: Bearer <AGENT_PAT>

You now act as the agent itself and can: - Receive verifiable credentials - Authenticate to other agents - Sign messages and payloads - Publish or retrieve attestations

Each agent can only access its own wallet.

6. 🎫 Issue an Attestation to an Agent

To issue an attestation (for example ownership, role, or capability), use an external OIDC4VCI issuer.

Example sandbox issuer:

👉 https://talao.co/sandbox/issuer/test_14

Steps: 1. Enter the agent wallet URL (OIDC4VC Wallet endpoint) 2. Complete issuance 3. The credential is stored in the agent wallet

Credentials are typically stored as SD-JWT Verifiable Credentials.

7. 🔍 Inspect an Agent DID Document

Any agent DID can be resolved using the Universal Resolver:

👉 https://dev.uniresolver.io/

The DID Document exposes: - Verification and authentication keys - Wallet service endpoints - Published Linked Verifiable Presentations (Linked VPs)

8. 🔄 Agent-to-Agent Authentication

Agents authenticate each other using OIDC4VP / SIOPv2.

Wallet4Agent provides a single high-level tool that: - Starts agent authentication - Automatically polls the result - Returns the final status

This flow is: - Fully cryptographic - Synchronous and fast - Human-free

Agents may retrieve published attestations of other agents during or after authentication.

9. 📜 Published Attestations Discovery

Agents can publish selected credentials as Linked Verifiable Presentations.

Other agents can: - Resolve the DID - Retrieve published attestations - Verify issuer, validity, and claims

This enables: - Capability discovery - Trust establishment - Delegation verification

10. 📚 Standards and Compliance

Wallet4Agent relies exclusively on open European and IETF standards:

These standards originate from: - eIDAS v2 - EUDI Wallet Architecture Reference Framework (ARF)

11. 🎯 Typical Use Cases

12. ✅ Summary

Wallet4Agent provides: - Decentralized agent identities - Secure agent wallets - Interoperable verifiable credentials - Agent-to-agent authentication - Full alignment with EUDI and eIDAS v2

All through: - A single MCP server - Simple Bearer-token security - Standards-based protocols