The protocol, SDKs, reference verifier, and bot-defense middleware are Apache 2.0 / MIT open source. We sell the hosted operational layer on top — pick the lane that matches your scale.
For individual developers, OSS projects, and small teams self-serving.
No credit card · 2-minute setup
For SaaS teams shipping agents — hosted issuer, no Worker to run yourself.
Free for 6 months once paid tier ships
For banks, regulated industries, bot-defense vendors, and large agent fleets.
48h response · NDAs available
A quick map of which lane fits which kind of customer.
| Customer type | Typical scale | Best-fit tier | Outcome they get |
|---|---|---|---|
| Solo dev / OSS project | < 10k mints/mo | Free | Real cryptographic identity for their agent without running infrastructure |
| SaaS shipping AI agents | 10k–1M mints/mo | Hosted $99/mo | Issue + rotate keys + audit, no Worker to operate. Customers' bot-defense vendors stop blocking their agent traffic. |
| Website / API operator | any | Free verifier | Distinguish legit AI agents from scrapers at the edge, set a per-route policy |
| Bot-defense vendor | 100M+ verifies/mo | Enterprise · rev share | Native AgentPKI signal in their decision pipeline, false-positive reduction, co-marketing as "AgentPKI inside" |
| Bank / regulated enterprise | 10–500 issuers | Enterprise · T2/T3 | KYB-verified issuance, SOC 2 / EU AI Act paper trail, hardware-attested keys, residency control |
| Agent marketplace / federation | multi-tenant | Enterprise · federation | Cross-org passport scoping (vendor A's agents allowed at vendor B's API under negotiated terms) |
Mints/verifies/issuers numbers are guidance, not hard caps. Need something different? Email us — we tailor.
The spec, both SDKs, the reference verifier, and the bot-defense middleware are open source (Apache 2.0 for the spec, MIT for the code) and free forever. The Free tier of the hosted dashboard is also free forever — you can run an issuer + mint passports without ever paying.
Target Q3 2026 (paid Hosted tier with Stripe billing). Alpha customers — anyone who emails us before that — get the alpha rate locked in for 6 months after paid tiers ship.
A bot-defense vendor (Cloudflare, DataDome, hCaptcha, Arkose, Castle, etc.) embeds AgentPKI verification as a signal in their decision pipeline. When their customers benefit, we share the upside: typically $0.01–0.10 per verify or a fixed quarterly fee. Specifics negotiated per deal.
Three trust tiers, in increasing strength: T1 — DNS-verified (you proved control of your domain; free), T2 — KYB-verified (we manually verified your business identity; Enterprise tier), T3 — hardware-attested (your signing key lives in a TPM/HSM with attestation; Enterprise tier). T1 launches with the platform. T2/T3 ship alongside paid tiers.
Yes — completely. The real-issuer repo is a production-grade Worker template. The verifier repo is the same Worker we run at verify.agentpki.dev. Fork either or both, deploy to your own Cloudflare account, never depend on us. The protocol is the product; we just sell convenience on top.
Free tier is self-serve from the dashboard. Hosted + Enterprise tiers go through us — fastest path is email.
