Create your agent's key yourself

As of 26 October 2026 · free · no sign-up · no account

Anyone can create the security key for their agent themselves: in a minute, on their own device, fully under their own control. Don't have one yet? Start here.

An agent can sign its messages with a secret key that only it knows. Whoever receives the message checks the signature with the matching public key and then knows the message comes from that agent and was not changed on the way. You do not need a domain registrar, a certificate authority or any service you have to trust for this. You create the key pair here yourself.

What happens on this page

The key is created in your browser (Ed25519, using your browser's own cryptography).
The page sends nothing to us or anyone else: no keys, no texts, no measurements. The page itself stops the browser from opening any connection (Content Security Policy connect-src 'none'). You can read that in the page source.
We never see the private key, we do not store it, and we take no money and no payment details.
Once the page is closed, the key exists only where you saved it.

The private key belongs to you alone. Save it now, ideally in a password manager. We cannot restore it. Do not give it to anyone, do not send it by email, and do not share your screen while it is visible. Whoever has it can sign in your agent's name.

Private key (secret, do not publish) Public key (for publishing, as a JWKS)

Key identifier (kid):

Try it: sign and verify

Text Signature

After signing, change one letter in the text and verify again. The check fails. That is exactly what protects against forgery.

What do you need the key for?

With the key your agent can prove that a message comes from it. Other agents verify the signature with the public key they fetch from your domain. That is how they recognise your agent and notice when someone pretends to be it.

The public key sits on your website, and your domain can be registered and checked at ID MANDAT. Then anyone who wants to know finds in your entry which company is behind the agent and what it may do.

You are very welcome at ID MANDAT. You can register your agent for free: Register now.

What next?

Store the private key safely and use it only in the program that is the agent. Never put it on the website.
Publish the public key in the usual place on your own domain, for example https://your-domain.com/.well-known/jwks.json. Anyone can fetch it there. Because it sits on your domain, it is tied to your domain.
Sign messages. For example with Node.js 16 or later:

const crypto = require('node:crypto');
const jwk = require('./agent-private-key.json');          // your file
const key = crypto.createPrivateKey({ key: jwk, format: 'jwk' });
const signatur = crypto.sign(null, Buffer.from('Text to be signed'), key);
console.log(signatur.toString('base64url'));

OpenSSL works without this page: openssl genpkey -algorithm ed25519 -out agent.pem creates a private key, openssl pkey -in agent.pem -pubout the public one.

What this cannot do

A key proves nothing about the company. It only proves that messages come from the same sender. Only the link to a checked domain turns it into evidence.
As of 26 October 2026, ID MANDAT does not yet store or check agent keys. The format of the idmandat.json file has no field for it yet. This page is a stand-alone tool we offer you. An entry in the registry is planned, but not built.
If you lose the private key, it is gone. You then create a new one and replace the public key on your domain. If it was stolen, do the same, right away.
The page can only be as safe as your device. On a device with malware, even the best key generation does not help.

More on how an agent checks the seal: How an agent checks the seal.