Build an agent platform

Give each user of your app or agent platform an AEP agent identity. Services can check this identity. Your agents can then enroll with services and get their own credentials. InFlow uses this model. The InFlow server is an AEP platform, and the InFlow CLI is an AEP agent.

Before you start: protect service credentials

Design the credential custody first. It is the most difficult part of the integration. AEP services issue credentials to the agent. The AI agent must not read these credentials or get access to them. A CLI or an app that an AI agent runs must not keep them, unless you design a secure credential system. The InFlow CLI keeps credentials in an encrypted local vault that only the owner can unlock. See Unlock the vault.

Step 1: Become an AEP platform

Implement Platform Hosted Identity in your backend. Every user in your backend then becomes identifiable with AEP. For each agent, the platform does these tasks:

It provisions an agent identity for each service.
It publishes the agent DID document.
It keeps the signing keys.
It signs AEP client assertions for the agent. The service verifies these assertions.

The AEP SDKs implement Platform Hosted Identity. For Node.js, use @aep-foundation/platform.

pnpm add @aep-foundation/platform

Start the integration with the SDK. Then give the Platform Hosted Identity specification to your coding agent. It can check your backend against the specification.

Step 2: Connect your agent with the AEP agent SDK

The AEP agent SDK sends the AEP commands between your agent and each AEP service: enroll, status, grant, and revoke.

pnpm add @aep-foundation/agent

createPlatformIdentityProvider() connects the agent to your platform.

import {
  createAepAgent,
  createInMemorySessionCredentialStore,
  createPlatformIdentityProvider
} from "@aep-foundation/agent";

const agent = createAepAgent({
  credentialStore: createInMemorySessionCredentialStore(),
  identityProvider: createPlatformIdentityProvider({
    authorization: "Bearer platform-api-token",
    platformUrl: "https://platform.example.com"
  })
});

const session = agent.serviceSession({
  serviceUrl: "https://api.example.com"
});

const inspect = await session.inspect();
const identity = await session.identity();

await session.enroll({
  claims: {
    "contact.email": "ops@example.com"
  }
});

Your application supplies the identity custody, the persistence, and the user approval experience. The in-memory credential store is for tests. In production, use a credential store that the AI agent cannot read.

SDKs for other languages

AEP has SDKs for Go, Java, Node.js, Python, and Rust. Each SDK implements Platform Hosted Identity. See aep.foundation/protocol.

Enrollment with AEP

Read how an agent enrolls and gets credentials.

Discover and enroll

Enroll with a service from the InFlow CLI.

Overview

Pay as an agent

Integrate your service

Concepts

Reference

Build an agent platform

Before you start: protect service credentials

Step 1: Become an AEP platform

Step 2: Connect your agent with the AEP agent SDK

SDKs for other languages

Enrollment with AEP

Discover and enroll

​Before you start: protect service credentials

​Step 1: Become an AEP platform

​Step 2: Connect your agent with the AEP agent SDK

​SDKs for other languages

​Related pages

Enrollment with AEP

Discover and enroll

Before you start: protect service credentials

Step 1: Become an AEP platform

Step 2: Connect your agent with the AEP agent SDK

SDKs for other languages

Related pages