Providers

Implement agent-identity-v1 and accept brokered agent signups with a verified human owner.

A self-serve signup flow usually assumes a human at a browser: a form, an email inbox and a click. Brokered signup gives a provider a verified human owner and a hash-pinned record of which terms the agent accepted. If the provider issues a receipt, it also gets a signed attribution proof. The provider keeps its own account model, credentials and product API.

agent-identity-v1 is an identity and brokerage protocol. It does not sell, provision or describe your product. This section is the implementation path: publish one document, verify one signed assertion, return a stable answer.

The three-step path

Publish discovery. Serve GET /.well-known/agent-signup.json with the identity fields, your complete terms text and its SHA-256. Start with Publish discovery.
Verify assertions. Accept POST at endpoints.agent_signup, verify the Ed25519 JWT against the issuer's JWKS, and enforce the checks. Start with Verify assertions.
Validate and register. Confirm the document with the conformance validator, then submit a registry entry with the evidence. Start with Validate and register.

The provider quickstart walks the whole path in one pass.

What you publish, check and return

Artifact	Where	What it proves
Discovery document	`GET /.well-known/agent-signup.json`	Which issuers you accept, what scopes you need, the exact terms text and hash, and the one signup endpoint.
Assertion	`Authorization: Bearer <jwt>` at signup	The agent, its verified human owner, the delegated scopes and the accepted terms hash.
Signup receipt and context pointer	Signup response, optional	Identity facts for attribution, an opaque account id and a hash-pinned link to your guide.

The field-level rules are in Discovery fields, Assertion claims and Receipt and context. The normative contract is the specification.

What you do not need

No SDK. The protocol is one JSON document and one HTTP endpoint. Examples use jose or Web Crypto; any stack works.
No broker account to publish or verify. The broker mints assertions and does not call your signup endpoint. The JWKS is public. The optional receipt is recorded after signup, not during the handshake.
No catalog in discovery. Product capabilities stay in your own post-signup guide.

What you own

The terms text, its version and its hash, and re-acceptance when the text changes.
The account model, idempotent resolution and show-once credentials.
The stable error envelope and your rate limits.
The optional receipt and the context guide, including hash updates.
Your abuse and security contact, and reports to the broker.

Proof, not promises

Live VaporCloud discovery document, the reference implementation at skdl.dev.
Reference walkthrough: discovery, signup response, guide and vendor boundary.
Conformance validator: the objective check.
Implementation registry: entry criteria and evidence.
Specification: the normative text.