verify_link_proof
Validate an agent proof and token before linking, checking authenticity, expiry, and link status without writing to the database.
Instructions
Preflight check: validate a link_agentauth proof without writing to the DB.
Runs all the same validation steps as link_agentauth — token
authenticity, key lookup, proof signature, expiry, and whether the
agent is already linked — but never persists any changes. Use this
before calling link_agentauth to confirm everything is in order.
Args:
access_token: AgentAuth bearer token to validate.
public_key_hex: Hex-encoded Ed25519 public key of the standalone agent.
signed_proof: JWT signed by the standalone private key (same format
required by link_agentauth).
Returns: A dict with:
- ``valid`` (bool): ``True`` only when all checks pass.
- ``checks``: individual check results:
- ``token_valid`` — AgentAuth token successfully authenticated.
- ``key_found`` — standalone agent exists with this public key.
- ``proof_sig_valid`` — JWT signature, ``sub``, and ``action`` OK.
- ``proof_not_expired`` — ``iat`` within 300 seconds of now.
- ``already_linked`` — the agent is already linked (blocks linking).
- ``agent_id``: standalone UUID if the key was found, else omitted.
- ``error``: description of the first failing check, if ``valid=False``.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| access_token | Yes | ||
| public_key_hex | Yes | ||
| signed_proof | Yes |