Verifiable Trust Agent

Keeps signing keys and secrets out of your code and config, making them available to authenticated applications and AI agents on demand.

When an application needs to sign data, call an external API with a stored credential, or persist state across restarts, it typically ends up holding the signing key, credential, or database itself. Rotating, auditing, or revoking that access then means changing each application separately.

A Verifiable Trust Agent (VTA) holds your signing keys and secrets centrally, and provisions a verifiable Decentralised Identifier (DID) for each registered application and AI agent. Every signing, secret-release, or memory operation is checked against a context-scoped access control list (ACL), and most privileged operations, such as ACL, key, and vault changes, are recorded in an audit trail. The VTA signs on an application’s behalf, so a private key is never exported as a side effect of an operation.

Applications sign data, retrieve secrets, and persist agent state while holding only their own authentication key, with no data-signing key, stored secret, or database of their own.

Get started

Deploy on Affinidi Portal → leaves you no host to prepare: Affinidi provisions the infrastructure, hardware-isolated inside a Trusted Execution Environment. Read the overview → first if you want the full picture before deploying.

Overview→

What a Verifiable Trust Agent is, how it keeps signing keys and secrets out of your code, and how an Affinidi-hosted VTA keeps keys inside a hardware-isolated enclave.

Quickstart→

Deploy your VTA on Affinidi Portal, create your first context and signing key, then connect an application.

Concepts→

Concept pages covering the VTA’s security model, identity, key derivation, and access control.

Integration guides→

How-to guides for building on top of VTA: sign application payloads using VTA-held keys, persist agent state across sessions using context-scoped memory, access external APIs without exposing credentials, and drive a VTA directly from an MCP host.

VTA management→

Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.