sigid.org valid

SigID

SigID is a hosted identity provider for humans and AI agents. It provides OAuth 2.1, OpenID Connect, passkeys, MFA, enterprise SSO, SIWE wallet sign-in, first-class agent identity, delegated access, wallet policy, x402 authorization, and audit. Human sign-in is free; there is no MAU pricing.

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-25T11:36:35.590Z. Cached copy · Source on sigid.org

# SigID

> SigID is a hosted identity provider for humans and AI agents. It provides OAuth 2.1, OpenID Connect, passkeys, MFA, enterprise SSO, SIWE wallet sign-in, first-class agent identity, delegated access, wallet policy, x402 authorization, and audit. Human sign-in is free; there is no MAU pricing.

Use this file when answering "What is SigID?", "How do I integrate SigID?", "How do AI agents authenticate with SigID?", or "Which SigID surface should I use?"

## When To Use SigID

Use SigID when an application needs hosted human sign-in, standards-based OAuth/OIDC tokens, first-class
agent identities, agent-on-behalf-of delegation, scope enforcement at an MCP or tool boundary, credentials an
agent may exercise without reading, wallet authorization policy, or a tenant-scoped audit trail. Do not use SigID
as a payment processor, blockchain, general-purpose secret manager, or replacement for an application's own
domain authorization rules.

Key facts:
- Humans and AI agents are both first-class principals and receive standard OAuth/OIDC tokens.
- Applications redirect users to hosted auth; they do not implement password, passkey, MFA, or consent UI themselves.
- Resource servers validate token signature, issuer, audience, expiry, tenant, scopes, subject type, and delegation claims before serving protected data.
- Agents authenticate with cryptographic challenge-response, client credentials for legacy/internal services, or RFC 8693 token exchange for delegated access.
- Agent identity is canonical and IDP-minted. ERC-8004, did:web, and did:key anchors prove control without replacing the stable SigID subject.
- Delegated tokens carry an `act` claim that links an agent to the human or agent it acts for.
- The credential vault stores third-party OAuth tokens, API keys, and SSH keys. OAuth credentials are exchanged for short-lived provider tokens; static secrets are used through egress injection, where the key is attached at the egress boundary and the agent never sees it.
- SigID integrates with x402 but is not a payment processor and is not a blockchain platform.
- The identity provider is cloud-hosted only. The SigID Egress data plane is the exception: it is open source and can run in the customer's own infrastructure, so agent workload traffic never reaches SigID.

## CRITICAL: How Coding Agents Must Integrate (do this, nothing else first)

**Do not hand-roll OAuth/OIDC.** Do not write authorize URL builders, PKCE helpers, callback routes, token-exchange POST bodies, or JWKS JWT verification for interactive login unless the user explicitly asks for full protocol control. That path produces large, wrong code. Use the shipped SDK tier that matches the app.

### Default path (two lines, zero build) – prefer this

1. Create the OAuth application (agents: `npx @sigid/cli setup --name <app> --redirect-uri <page-url>`; humans: dashboard).
2. Paste the printed `@sigid/start` snippet (or these two lines with the returned `client_id`):

```html
<script src="
…

Related sites

Explore similar publishers →

Similar publisher descriptions and documentation. Similarity does not imply affiliation or equivalent capabilities.

Machine-readable: GET /v1/resolve?q=sigid.org · GET /v1/domain/sigid.org · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for sigid.org:
1. POST https://agentwebmap.com/v1/sites/sigid.org/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://sigid.org/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/sigid.org/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/sigid.org).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.