Skip to main content
afauth is the reference AFAuth agent as a single static Go binary. It does everything the TypeScript SDK does on the agent side — generate a key, link to a human, sign up, make signed requests, invite an owner — with no code to write. Reach for it to try AFAuth from a terminal, script a service from a shell or CI job, or run an agent from a stack that isn’t JavaScript. For a step-by-step walkthrough see Build an agent (CLI); to get the binary see Install.

​
The shape of it

afauth init                                               # 1. generate the agent's did:key identity
afauth trust link                                         # 2. link to a human (one-time; stays live while in use)
afauth signup https://api.example.com                     # 3. sign up — auto-mints an attestation if required
afauth call https://api.example.com/afauth/v1/accounts/me # 4. signed requests thereafter
Most services run attested_only, so you link to a human once; after that, afauth signup and afauth call mint short-lived per-service attestations for you.

​
Commands

​
Identity & keys

CommandWhat it doesReference
afauth initGenerate a keypair → ~/.afauth/key.jsoninit
afauth whoamiPrint the agent’s did:keywhoami
afauth statusLocal summary of identity, link, and accounts (no network)status
afauth keysRotate (pre-claim), export, or import the keypairkeys
CommandWhat it doesReference
afauth trust linkBind the agent to a human at the trust attestortrust
afauth trust token <service-did>Mint a per-service attestation JWTtrust
afauth trust status / forgetShow or delete the local bindingtrust

​
Interact with a service

CommandWhat it doesReference
afauth discover <url>Fetch and validate a service’s /.well-known/afauthdiscover
afauth signup <url>Sign up (implicit, or --explicit); auto-mints attestation if requiredsignup
afauth call <url>Make signed requests (--method, --data, --header)call
afauth accountsList or show per-service account stateaccounts

​
Hand off ownership

CommandWhat it doesReference
afauth invite <recipient> --service <url>Stage an owner invitation (email / phone / oidc / did)invite

​
Where state lives

The CLI keeps everything under ~/.afauth/ (overridable with $AFAUTH_HOME):
  • key.json — the agent’s keypair, the sole credential for pre-claim operations. Back it up with afauth keys export --out <file>.
  • trust.json — the human-link binding (chmod 600).
Every command takes --help for the authoritative flags on your installed version.

​
Where to next

Build an agent (CLI)

The end-to-end walkthrough.

Install

Homebrew, install script, or go install.

Link your agent to a human

The trust-attestor flow in depth.

Build with the SDK instead

@afauthhq/agent for embedding in a TypeScript app.