afauth CLI - AFAuth

afauth is the reference AFAuth agent as a single static Go binary. It does everything the TypeScript SDK does on the agent side — generate a key, link to a human, sign up, make signed requests, invite an owner — with no code to write. Reach for it to try AFAuth from a terminal, script a service from a shell or CI job, or run an agent from a stack that isn’t JavaScript. For a step-by-step walkthrough see Build an agent (CLI); to get the binary see Install.

The shape of it

afauth init                                               # 1. generate the agent's did:key identity
afauth trust link                                         # 2. link to a human (one-time; stays live while in use)
afauth signup https://api.example.com                     # 3. sign up — auto-mints an attestation if required
afauth call https://api.example.com/afauth/v1/accounts/me # 4. signed requests thereafter

Most services run attested_only, so you link to a human once; after that, afauth signup and afauth call mint short-lived per-service attestations for you.

Commands

Identity & keys

Command	What it does	Reference
`afauth init`	Generate a keypair → `~/.afauth/key.json`	init
`afauth whoami`	Print the agent’s `did:key`	whoami
`afauth status`	Local summary of identity, link, and accounts (no network)	status
`afauth keys`	Rotate (pre-claim), export, or import the keypair	keys

Link to a human

Command	What it does	Reference
`afauth trust link`	Bind the agent to a human at the trust attestor	trust
`afauth trust token <service-did>`	Mint a per-service attestation JWT	trust
`afauth trust status` / `forget`	Show or delete the local binding	trust

Interact with a service

Command	What it does	Reference
`afauth discover <url>`	Fetch and validate a service’s `/.well-known/afauth`	discover
`afauth signup <url>`	Sign up (implicit, or `--explicit`); auto-mints attestation if required	signup
`afauth call <url>`	Make signed requests (`--method`, `--data`, `--header`)	call
`afauth accounts`	List or show per-service account state	accounts

Hand off ownership

Command	What it does	Reference
`afauth invite <recipient> --service <url>`	Stage an owner invitation (`email` / `phone` / `oidc` / `did`)	invite

Where state lives

The CLI keeps everything under ~/.afauth/ (overridable with $AFAUTH_HOME):

key.json — the agent’s keypair, the sole credential for pre-claim operations. Back it up with afauth keys export --out <file>.
trust.json — the human-link binding (chmod 600).

Every command takes --help for the authoritative flags on your installed version.

Where to next

Build an agent (CLI)

The end-to-end walkthrough.

Install

Homebrew, install script, or go install.

Link your agent to a human

The trust-attestor flow in depth.

Build with the SDK instead

@afauthhq/agent for embedding in a TypeScript app.

​The shape of it

​Commands

​Identity & keys

​Link to a human

​Interact with a service

​Hand off ownership

​Where state lives

​Where to next