> ## Documentation Index
> Fetch the complete documentation index at: https://ifdocdemo.lumivescence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Build an agent platform

> Make each user of your app or agent platform identifiable with AEP. Keep service credentials away from the AI agent.

Give each user of your app or agent platform an AEP agent identity. Services can check this identity. Your agents can then enroll with services and get their own credentials.

InFlow uses this model. The InFlow server is an AEP platform, and the InFlow CLI is an AEP agent.

## Before you start: protect service credentials

Design the credential custody first. It is the most difficult part of the integration.

AEP services issue credentials to the agent. The AI agent must not read these credentials or get access to them. A CLI or an app that an AI agent runs must not keep them, unless you design a secure credential system.

The InFlow CLI keeps credentials in an encrypted local vault that only the owner can unlock. See [Unlock the vault](/agents/install-the-cli#unlock-the-vault).

## Step 1: Become an AEP platform

Implement Platform Hosted Identity in your backend. Every user in your backend then becomes identifiable with AEP. For each agent, the platform does these tasks:

* It provisions an agent identity for each service.
* It publishes the agent DID document.
* It keeps the signing keys.
* It signs AEP client assertions for the agent. The service verifies these assertions.

The AEP SDKs implement Platform Hosted Identity. For Node.js, use `@aep-foundation/platform`.

```sh theme={null}
pnpm add @aep-foundation/platform
```

Start the integration with the SDK. Then give the [Platform Hosted Identity specification](https://www.aep.foundation/draft/platform-hosted-identity/) to your coding agent. It can check your backend against the specification.

## Step 2: Connect your agent with the AEP agent SDK

The AEP agent SDK sends the AEP commands between your agent and each AEP service: enroll, status, grant, and revoke.

```sh theme={null}
pnpm add @aep-foundation/agent
```

`createPlatformIdentityProvider()` connects the agent to your platform.

```ts theme={null}
import {
  createAepAgent,
  createInMemorySessionCredentialStore,
  createPlatformIdentityProvider
} from "@aep-foundation/agent";

const agent = createAepAgent({
  credentialStore: createInMemorySessionCredentialStore(),
  identityProvider: createPlatformIdentityProvider({
    authorization: "Bearer platform-api-token",
    platformUrl: "https://platform.example.com"
  })
});

const session = agent.serviceSession({
  serviceUrl: "https://api.example.com"
});

const inspect = await session.inspect();
const identity = await session.identity();

await session.enroll({
  claims: {
    "contact.email": "ops@example.com"
  }
});
```

Your application supplies the identity custody, the persistence, and the user approval experience. The in-memory credential store is for tests. In production, use a credential store that the AI agent cannot read.

## SDKs for other languages

AEP has SDKs for Go, Java, Node.js, Python, and Rust. Each SDK implements Platform Hosted Identity. See [aep.foundation/protocol](https://www.aep.foundation/protocol/).

## Related pages

<CardGroup cols={2}>
  <Card title="Enrollment with AEP" icon="id-card" href="/concepts/enrollment">
    Read how an agent enrolls and gets credentials.
  </Card>

  <Card title="Discover and enroll" icon="compass" href="/agents/discover-and-enroll">
    Enroll with a service from the InFlow CLI.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.