Introduction to Vestauth

Web-bot-auth for agents - cryptographic identities, authentication, and tools for autonomous agents

What is Vestauth?

Vestauth gives agents cryptographic identities and a simple way to authenticate HTTP requests. Instead of API keys, bearer tokens, or passwords, Vestauth uses public/private key cryptography built on open internet standards.

Created by @motdotla, the creator of dotenv and dotenvx.

Vestauth implements RFC 9421 (HTTP Message Signatures) and the Web-Bot-Auth draft specification.

Key Features

Cryptographic Identity

Give agents Ed25519 key-based identities. No shared secrets, just cryptographic proof.

Built-in Tools

Call file storage, geolocation, secrets, and more with signed requests.

Simple Authentication

Verify agent requests with a single line: vestauth.tool.verify(method, url, headers)

Self-Hosting Ready

Run your own Vestauth infrastructure with PostgreSQL backend.

How It Works

Vestauth replaces shared secrets with cryptographic signing:

1. Agent generates a keypair - Public and private Ed25519 keys stored in .env
2. Agent signs HTTP requests - Private key creates unforgeable signatures
3. Tool verifies signatures - Public key proves the request came from that agent
4. No secrets transmitted - Only signatures are sent over the network

Agent Side

# Initialize an agent
vestauth agent init

# Make authenticated requests
vestauth agent curl https://api.vestauth.com/whoami --pp

Why Vestauth?

No Shared Secrets

Private keys never leave the agent. Public keys are safe to share.

Easy Key Rotation

Rotate keys without disrupting your agents: vestauth agent rotate

Strong Attribution

Every request is cryptographically tied to a specific agent identity.

Replay Protection

Built-in nonces, timestamps, and expiration prevent replay attacks.

Standards Based

Built on RFC 9421 and Web-Bot-Auth specifications.

Developer Friendly

Simple CLI, drop-in curl wrapper, and minimal API surface.

Comparison with Other Auth Methods

Capability	Vestauth	API Keys	OAuth	Cookies
No browser required	✅	✅	⚠️	❌
Easy to automate	✅	✅	⚠️	❌
No shared secret	✅	❌	⚠️	❌
Per-request identity proof	✅	❌	⚠️	❌
Easy key rotation	✅	⚠️	⚠️	⚠️
No secret storage (tool side)	✅	❌	❌	❌
Strong agent attribution	✅	⚠️	⚠️	❌
Stateless verification	✅	✅	✅	❌

Ready to give your agents an identity? Start with the Quickstart guide.

Use Cases

Vestauth isn’t just for AI agents. Use it for:

• AI agents and autonomous systems
• Developer tools and CLIs
• Automation services and workflows
• Bots and scheduled tasks
• Infrastructure tools and monitoring

Standards Compliance

Vestauth builds on proven internet standards:

RFC 9421

HTTP Message Signatures - defines how requests are cryptographically signed and verified

Web-Bot-Auth Draft

Authentication architecture and headers for autonomous agents

Next Steps

Quickstart

Get your first agent running in 2 minutes

Installation

Install Vestauth via npm, curl, or GitHub releases

Call Tools

Learn how to use built-in and third-party tools

Build Tools

Create your own tools with simple verification