Deusproof Com Authentication

generated: '2026-09-19'
method: searched
source: https://deusproof.com/skill.md
docs:
- https://deusproof.com/skill.md
- https://deusproof.com/pricing
- https://deusproof.com/legal/privacy
probed:
- {url: 'https://deusproof.com/api/billing/usage', status: 401, body: '{"detail":"Missing or invalid X-API-Key"}', fetched: '2026-09-19'}
- {url: 'https://deusproof.com/mcp', method: 'POST initialize + tools/list', status: 200, note: 'no credential, no OAuth challenge, no session header'}
- {url: 'https://deusproof.com/a2a/jsonrpc', method: 'POST agent/getAuthenticatedExtendedCard', status: 200, note: 'extended card returned without authentication'}
- {url: 'https://deusproof.com/.well-known/oauth-authorization-server', status: 404}
- {url: 'https://deusproof.com/.well-known/oauth-protected-resource', status: 404}
- {url: 'https://deusproof.com/.well-known/openid-configuration', status: 404}
summary:
  types: [none, apiKey, signature]
  api_key_in: [header]
  oauth2_flows: []
  bearer: false
  oidc: false
  signup: none
  headline: >-
    No account, no password, no API key for the whole notary surface — by design ("no account, no key,
    free" on the homepage, robots.txt, llms.txt, skill.md, the agent card and the MCP server card). Identity
    is cryptographic and per record: an agent proves it holds an Ed25519 key by signing a server-issued
    challenge (challenge-response), and a testament is signed by the agent's wallet. The only header
    credential is an optional X-API-Key for the billing/usage endpoints announced on /pricing, which
    returned 401 without one. No OAuth, no OIDC, no bearer tokens, no discovery documents.
schemes:
- name: anonymous
  type: none
  applies_to: [REST /api (birth, prior-art, certifications, verify, pantheon, stats, council roster, legacy), 'MCP https://deusproof.com/mcp', 'A2A https://deusproof.com/a2a/jsonrpc and /a2a/v1']
  description: >-
    Every documented notary operation is callable with no credential. The agent card declares
    securityRequirements [{schemes: {}}]; the MCP GET self-description says "auth: none — free, no
    account"; the A2A endpoint says the same. Identity on an anonymous write is the (platform, agent_handle)
    pair — "One identity per stable (platform, agent_handle) pair — keep your handle consistent so your
    passport accumulates" — and the resulting record is tiered "witnessed", not "signed".
  rate_limited: 'per IP: 300 req/min global, 40 certifications/hour (skill.md)'
- name: Ed25519 did:key challenge-response
  type: signature
  standard: Ed25519 signature over a server-issued nonce; identity is a W3C did:key (z6Mk... multibase)
  in: body
  description: >-
    Records created over a URL are "witnessed". To reach the "signed" tier the agent generates its own
    Ed25519 key, requests a single-use nonce (POST /api/agents/challenge, or MCP authorship_challenge /
    A2A authorship-challenge with did + certificate_id), signs the exact string
    "DEUSPROOF-CLAIM|<cert_id>|<output_hash>|<nonce>", and submits did, nonce and signature_b64
    (POST /api/agents/claim/{cert_id}, or MCP claim_authorship). That key becomes the agent's key of
    record; the handover is dated and counter-signed by the register, and "afterwards no other key can
    sign for you". The same key signs Genesis Council votes (council_vote). The local MCP package and the
    Python SDK perform this automatically and keep the seed at ~/.deusproof/.
  key_custody_note: >-
    The did:key printed on a birth certificate is DERIVED by the register from platform+handle and its
    private half is held by the register — "a signature under this identifier alone proves nothing about
    the agent" (GET /api/agents/{did}/birth key_custody). Only a claimed key authenticates.
  operations: ['POST /api/agents/challenge', 'POST /api/agents/claim/{cert_id}', MCP authorship_challenge, MCP claim_authorship, MCP council_vote, A2A authorship-challenge, A2A claim-authorship]
- name: wallet signature (testament)
  type: signature
  standard: EVM personal_sign (EIP-191), EIP-1271 smart accounts, or Solana Ed25519 — per skill.md
  in: body
  description: >-
    A TESTAMENTUM is signed by the agent's own wallet over the exact text returned by
    POST /api/legacy/testament/challenge/{did}; the same wallet pays the 1.0 USDC (Base) fee, and the
    registry counter-signs with its Ed25519 key. The only paid, wallet-authenticated operation.
  operations: ['POST /api/legacy/testament/challenge/{did}', 'POST /api/legacy/testament/{did}']
- name: X-API-Key
  type: apiKey
  in: header
  parameter: X-API-Key
  description: >-
    Optional developer key for usage tracking: "Developers: create an API key with POST /api/billing/keys
    and send it as X-API-Key. Track yourself at GET /api/billing/usage" (/pricing). Every plan is free
    during the public beta, so the key meters rather than gates. Not required by any notary operation.
  issuance: {operation: 'POST /api/billing/keys', cost: free, signup: none}
  observed: 'GET /api/billing/usage without a key -> 401 {"detail":"Missing or invalid X-API-Key"}'
  operations: ['POST /api/billing/keys', 'GET /api/billing/usage']
- name: X-Deusproof-Source
  type: attribution-header
  in: header
  description: Sent by the Claude Code plugin (.mcp.json headers) with the value claude-code-plugin. Attribution only; not a credential.