Identify InFlow customers

Find out which of your customers come from InFlow. Every InFlow agent that enrolls with your service has an agent DID on the InFlow domain.

Before you start

Your service supports Onboard (AEP). See Enroll agents.

How InFlow identifies its agents

InFlow is an AEP platform. It hosts the identity of each InFlow agent. For each agent, InFlow does these tasks:

It gives the agent a did:web agent DID on the InFlow domain.
It publishes the agent DID document with the public key of the agent.
It keeps the private key and signs the requests of the agent.

An InFlow agent DID has this format:

Environment	Agent DID prefix	DID document URL
production	`did:web:app.inflowpay.ai:agents:`	`https://app.inflowpay.ai/agents/<id>/did.json`
sandbox	`did:web:sandbox.inflowpay.ai:agents:`	`https://sandbox.inflowpay.ai/agents/<id>/did.json`

This is an example of a production agent DID:

did:web:app.inflowpay.ai:agents:7ffb473b5a650a45fa84c1f3af73c346

Step 1: Read the agent DID

The service SDK gives you the agent DID after it checks the signature of the request.

When	Where to read the agent DID
The agent enrolls	`agent_did` in the Enroll request. Your enrollment store keeps it as `agentDid`.
The agent calls a protected endpoint	`principal.agentDid` in the result of `authenticateProtectedResource()`

Step 2: Compare the prefix

If the agent DID starts with the InFlow prefix, the customer comes from InFlow.

const INFLOW_AGENT_DID_PREFIX = "did:web:app.inflowpay.ai:agents:";

const result = await service.authenticateProtectedResource({ headers, method, url });

if (result.authenticated) {
  const fromInflow = result.principal.agentDid.startsWith(INFLOW_AGENT_DID_PREFIX);
}

Compare the prefix only after the SDK checks the request. Do not read the agent DID from the raw request body.

In production, accept only the production prefix. A sandbox agent DID starts with did:web:sandbox.inflowpay.ai:agents:.

Why the prefix is reliable

The SDK gets the public key of the agent from the DID document on app.inflowpay.ai. Then it checks the signature of the request with that key. Only InFlow can publish a DID document on that domain. Thus, a request that passes the check with an InFlow agent DID comes from an InFlow agent.

What the agent DID does not tell you

One agent DID for each service. InFlow gives an agent a different agent DID for each service. Use the agent DID to identify a customer in your service. You cannot use it to find the same agent in other services.
No enrollment, no agent DID. A payment with MPP or x402 that has no AEP enrollment has no agent DID. To identify every customer, ask for enrollment before you accept a payment.

Step 3: Test with the CLI

Enroll with your service as an InFlow agent. Log in with inflow auth login. Make sure that the vault is unlocked.

inflow aep enroll https://api.example.com --interval 5
inflow aep status https://api.example.com --format json

Approve the enrollment when the CLI shows an approval URL. Then look at the agent DID that your service records. It must start with the InFlow prefix. Open the DID document of that agent DID to see the public key that your service uses.

curl https://app.inflowpay.ai/agents/<id>/did.json

Next step

List your products

Publish your catalog, so that agents can find your products and their prices.

Get started

Get paid

Know the customer

Get found

Publish

Identify InFlow customers

Before you start

How InFlow identifies its agents

Step 1: Read the agent DID

Step 2: Compare the prefix

Why the prefix is reliable

What the agent DID does not tell you

Step 3: Test with the CLI

Next step

List your products