Verify a credential with nobody on the line
ATX is the credential face: AIP proves the key, ATP logs the trust, and ATX packs all of it into one signed, self-contained credential the agent carries and any verifier checks locally.
Before the spec: the usual way
The usual way: on every call, ask a central authority 'is this agent still trusted?'. The request blocks on the network, latency climbs, and if the authority is down, trust breaks.
nothing yet
The Ed25519 signature here is verified for real in your browser, so tampering any signed field fails. The ML-DSA-65 post-quantum signature is present and verified in production; the lab labels it rather than re-running a heavy PQ check on a phone. Revocation is a locally cached list plus a short credential lifetime, not a live lookup. A structured capability-scope (declared purpose) is a proposed v1.1 extension, not part of ATX 1.0.
import { LocalAtxVerifier } from "@opena2a/atx-verify";
// No callback: version, expiry, revocation, issuer trust, and the Ed25519
// signature are all checked locally. Anchors are injected; the library does no I/O.
const verifier = new LocalAtxVerifier({
trustedIssuers: ["did:opena2a:authority:opena2a.org"],
publicKeys: cachedIssuerKeys, // e.g. from the issuer's DID Document, 1-hour TTL
crl: localRevocationCache, // 5-minute TTL
});
const result = verifier.verify(credential);
if (result.valid) proceed(); // local check, safe even if the authority is offline