> For the complete documentation index, see [llms.txt](https://docs.zipwire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zipwire.io/fundamentals/security/attestations/authorizing-your-agent.md). # Authorizing Your Agent Step-by-step guide to authorizing an AI agent to act on your behalf This guide walks you through the complete process of authorizing an AI agent (like Claude Code) to act on your behalf using blockchain attestations. ## The Overview By the end of this guide, your agent will have cryptographic proof that you've authorized it to make requests on your behalf. Services can then check that a verified human stands behind your agent, without learning who you are. The process happens in two parts, both inside Zipwire: 1. **Get verified** - You verify your identity and claim your IsAHuman attestation 2. **Attest your agent** - You sign an IsDelegate attestation, from your own wallet, that links your agent's wallet back to your IsAHuman You no longer need to visit the EAS website or copy UIDs around by hand. ## Part 1: Get Your IsAHuman Attestation ### Step 1: Visit Zipwire Attest Go to [Zipwire Attest](https://zipwire.io/attest) and create an account. ### Step 2: Connect Your Wallet Connect the Ethereum wallet you want to use. This can be: * MetaMask * Coinbase Wallet * Any wallet supporting WalletConnect * Smart wallets (e.g., Coinbase Smart Wallet) ### Step 3: Complete ID Verification Pay the ID verification fee and complete the Yoti identity check: 1. Government ID verification 2. Liveness check (selfie) 3. AML check (optional, depending on your jurisdiction) ### Step 4: Claim Your IsAHuman Attestation After verification completes, you'll see your Claims Dashboard. Click **"Claim"** on the IsAHuman attestation. You'll be asked to sign a transaction in your wallet. Once confirmed, Zipwire will attest your identity to the blockchain. ## Part 2: Attest Your Agent in Zipwire ### Step 1: Open the Attest tab In Zipwire, go to **My proofs → Attest**. ### Step 2: Connect the same wallet Connect the wallet that holds your IsAHuman attestation. The page refuses a different account, because the delegation has to come from the wallet Zipwire verified. ### Step 3: Enter your agent's details * **Agent's wallet address** - the wallet your agent uses (e.g. a wallet you control for Claude Code). * **Name** (optional) - something to help you recognise it later, like "Claude Code laptop". It's stored privately in Zipwire and is **not** put on-chain. ### Step 4: Choose how long it lasts Pick **7 days**, **30 days**, **90 days** or **1 year**. The delegation always expires; you can create a new one when it does. ### Step 5: Review and sign Click **Review and sign**. The review shows what you're about to sign: * ✅ Attester = your wallet * ✅ Recipient = your agent's wallet * ✅ refUID = your IsAHuman attestation UID (filled in for you) * ✅ Expiry = the date your chosen duration ends * ✅ Revocable = yes Sign the transaction in your wallet. **You pay a small network fee in ETH on Base Mainnet**, so the wallet needs a little ETH on Base. Zipwire doesn't sign this for you and holds no key that can act for you. ### Step 6: Confirmation Once the transaction confirms, Zipwire reads the new attestation back from the chain and lists it on the page. Your agent now has on-chain proof that a verified human authorised it. ## What Your Agent Can Now Do ### Option A: Quick wallet verification The agent gives a service its wallet address. The service checks the chain with ProofPack's `IsDelegateAttestationVerifier.verifyByWallet`, or with the public [IsDelegate API](/api/zipwire-attest/isdelegate-api.md) (`GET https://zipwire.io/api/v1/is-delegate/{wallet}`), and gets a yes/no: is this wallet authorised by a verified human? A wallet address on its own doesn't prove the request came from the agent. See [Proving your agent holds the wallet](#proving-your-agent-holds-the-wallet). ### Option B: Full proof with claims If a service needs more (e.g. "over 18", nationality), you can mint a ProofPack for your agent via the [ProofPack Mint API](/api/zipwire-attest/proofpack-mint-api.md). It discloses only the fields you choose, plus the delegation chain. ## Proving Your Agent Holds the Wallet A wallet address is public: it's on-chain in your IsDelegate. So a delegate check alone tells a service that a verified human authorised *that address*, not that the caller holds its key. Services that need that should run a standard **Sign-In with Ethereum (SIWE,** [**EIP-4361**](https://eips.ethereum.org/EIPS/eip-4361)**)** challenge first. **For services, today:** 1. Build a SIWE message with **your own** domain and URI, a random single-use nonce, and an expiry about 5 minutes out. Store the nonce. 2. Send it to the agent. The agent signs it with `personal_sign` using its key, which never leaves the agent. 3. Verify with any SIWE library: the signature recovers to the agent's address, the domain and URI are yours, the nonce is unused (mark it used), it hasn't expired, and the chain ID is one you accept (8453 for Base). 4. Then check the delegation for that address with ProofPack `verifyByWallet` or the [IsDelegate API](/api/zipwire-attest/isdelegate-api.md). Example message: ``` api.example.com wants you to sign in with your Ethereum account: 0x1234567890abcdef1234567890ABCDEF12345678 Prove control of this agent wallet. URI: https://api.example.com/agents/verify Version: 1 Chain ID: 8453 Nonce: 8f3k2LwQx9TzA1bC Issued At: 2026-10-31T10:30:00Z Expiration Time: 2026-10-31T10:35:00Z ``` Agent side, in Python: ```python from eth_account import Account from eth_account.messages import encode_defunct signed = Account.sign_message(encode_defunct(text=message), private_key=key) # key from the agent's vault signature = signed.signature.hex() ``` Always use your own domain. Don't accept signatures over another service's message (including Zipwire's): a malicious service could relay a challenge and replay the answer. **Or let Zipwire check it.** Zipwire runs the same pattern at [`POST /api/v1/is-delegate/verify`](/api/zipwire-attest/isdelegate-api.md#verify-control-post-api-v1-is-delegate-verify). Send the wallet address and you get a SIWE challenge back (HTTP `401` with `WWW-Authenticate: SIWE`). The agent signs it and sends the message and signature to the same endpoint, and the `200` response says `controlProven: true` alongside a fresh delegation check. This proves control *to Zipwire*; if you relay it from your own service, read the caveat in the API docs first. ## Privacy: pseudonymous, not anonymous A service doing the wallet check learns that a Zipwire-verified human stands behind the agent, not who you are. But the chain is public on Base: anyone can see your wallet address and that it delegates to the agent's wallet. ## What's Not There Yet To be straight about it, these are **not** built yet: * Creating, listing or revoking delegations from the `zw` CLI or MCP tools * Agents signing in to Zipwire's own API with a ProofPack (the API still takes an API key or OAuth token) * Creating sub-agent delegations in the Zipwire UI (verification supports chains, but you can't create sub-delegations from the page) * Proving you control the agent's wallet when you attest it * Capabilities or scoped permissions (the `capabilitiesUID` field is always `0x0` for now) * Smart-contract (EIP-1271) agent wallets on the verify endpoint, an access token from it, and a ProofPack helper for proving an agent holds its wallet * Per-request signing ## Troubleshooting ### "The page won't let me sign" Make sure you've connected the same wallet that holds your IsAHuman attestation, that it's on Base Mainnet, and that it has a little ETH for the network fee. ### "I'm not sure which wallet is my agent's" If you're running the agent yourself, use a wallet you control for it. If a service provides the agent, they'll give you its wallet address. Double-check it: Zipwire can't yet verify that the address belongs to your agent. ### "I want to revoke my agent's authorization" Go back to **My proofs → Attest**, find the agent in your list and revoke it. You sign the revocation from your wallet (again, a small Base fee). Verifiers then see the delegation as revoked. ## Next Steps * **For services**: Use the [ProofPack library](https://github.com/zipwireapp/ProofPack) or the [IsDelegate API](/api/zipwire-attest/isdelegate-api.md) to verify agents authorized this way * **Learn more**: Read about [IsDelegate Attestations](/fundamentals/security/attestations/isdelegate-agent-delegation.md) *** **Questions?** Check the [ProofPack documentation](https://github.com/zipwireapp/ProofPack) or contact Zipwire support.