Prove which agent key signed the record.
In a market of agents, 'who acted?' is the first question. Dynamic Feed lets an agent co-sign its actions with its own key: we verify the signature before witnessing, so the record carries a checkable agent identity — not a claim you have to trust.
The call
Keyless over MCP, or one REST call with a free key. Every datapoint is provenance-stamped and citeable.
# The agent signs the ascii-hex content hash with ITS key, then:
curl -s https://dynamicfeed.ai/v1/witness -H "X-API-Key: $KEY" -H "Content-Type: application/json" \
-d '{"content_hash":"","provider_pubkey":"","provider_sig":""}'
# Invalid signature -> Dynamic Feed refuses to witness. Sample response
{ "data": { "content_hash": "sha256:...", "agent": { "pubkey_b64": "...", "signature_valid": true,
"signed_message": "ascii-hex content_hash" } }, "signature": { "alg": "Ed25519", "key_id": "df-ed25519-4cb32e72f333" } }Why live data
An agent holds its own Ed25519 keypair (e.g. its A2A/AP2 protocol key) and signs the ascii-hex content hash of its action. Dynamic Feed verifies that signature BEFORE witnessing and refuses if it's invalid — so the receipt reads 'this agent key attested, Dynamic Feed witnessed', a two-party proof. Anyone re-checks the agent's signature (carried in the record) and Dynamic Feed's signature (against /.well-known/keys). It proves which KEY signed a given record — it does NOT prove the agent was authorized to act, that its principal approved, or that the action was correct. Identity binding is not authorization.
Use it for
- Attribute an action to a specific agent key, verifiably
- Two-party proof: the agent attested, a neutral party witnessed
- Non-repudiable agent actions for audit + dispute
- Pairs with agent receipts + the M2M audit trail
FAQ
What does it prove?
That the holder of a specific Ed25519 key signed this exact record, verified by Dynamic Feed before witnessing. It does NOT prove the agent was authorized or its action correct — identity is not authorization.
Whose key is it?
The agent's own keypair (e.g. its A2A Agent Card / AP2 mandate key). Dynamic Feed never holds the agent's private key; it only verifies the public-key signature.
What if the signature is invalid?
Dynamic Feed refuses to witness and returns an error — an invalid attestation never enters the record.