Pact

Pact is a cryptographic protocol where a human signs a narrowing-only delegation to an agent, and the agent signs every HTTP request. A provider verifies the whole chain locally from the request headers, with no token introspection, no auth server and no network calls. The Go library uses only the standard library, ships drop-in middleware and an OAuth bridge, and has a Python SDK that interoperates with it.

How it works

1. 01

   A human generates an Ed25519 key and signs a delegation naming the agent, its capabilities and an expiry.

2. 02

   The agent attaches its delegation chain and signs each request's method, path, timestamp and body digest.

3. 03

   The provider walks the chain, checks every signature, confirms the capabilities cover the request and that it is fresh, all from the request headers.

What it does

• Self-sovereign Ed25519 identity with no registration
• Narrowing-only delegation chains with expiry and depth limits, so a sub-agent can never gain permissions
• Per-request RFC 9421 signatures instead of bearer tokens, so there is nothing to steal
• Session identities: a persistent root key delegates to an ephemeral per-process key, revocable without touching the root
• Drop-in Go middleware, an OAuth bridge for existing backends, a CLI and a Python SDK (pact-auth)