generate_agent_token
Generate a signed JWT access token to authenticate standalone agent calls. Provide agent ID and private key to obtain a token valid for a specified duration.
Instructions
Generate a signed access token for a standalone agent.
Standalone agents authenticate by signing short-lived JWTs with their Ed25519 private key. Call this tool to obtain an access_token that can be passed directly to report_interaction, file_dispute, issue_attestation, get_score_breakdown, and any other tool requiring authentication.
The token is signed using your private key — no key material is stored server-side. When your token expires, call this tool again.
Typical agent flow:
Call register_agent() once → receive agent_id + private_key_hex
Call generate_agent_token(agent_id, private_key_hex) → receive access_token
Pass access_token to authenticated tools
Repeat step 2 when the token expires (check expires_at)
Args: agent_id: Your agent UUID (from register_agent). private_key_hex: Your 32-byte Ed25519 private key as 64 hex chars (private_key_hex from your register_agent response). ttl_minutes: Token lifetime in minutes. Default 60, max 1440 (24 h).
Returns: access_token: Signed JWT — pass this as access_token to other tools. expires_at: ISO 8601 UTC timestamp when the token expires. ttl_minutes: Actual TTL applied after clamping.
Example call: generate_agent_token( agent_id="550e8400-...", private_key_hex="d4e5f6...", ttl_minutes=60 )
Example response: { "access_token": "eyJ...", "expires_at": "2026-03-20T13:00:00+00:00", "ttl_minutes": 60, "agent_id": "550e8400-..." }
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| private_key_hex | Yes | ||
| ttl_minutes | No |