Skip to content
Ratify Protocol Ratify Protocol

Ratify Protocol

Delegated-authority proofs for human-agent and agent-agent interactions. When a human authorizes an agent, or one agent transacts with another, Ratify produces a signed, verifiable proof of *who* authorized *what*, *within which bounds*, and *for how long*. Any party can check it in under a millisecond.
Quickstart (60 seconds) Concepts — Delegate, Present, Verify View on GitHub

Where to start

Section titled “Where to start”

Build with the protocol

Open SDKs in Go, TypeScript, Python, Rust, and C/C++. Free under Apache-2.0. Byte-for-byte interoperable across all five. Pick a language →

Understand the protocol

The mental model is three verbs: Delegate, Present, Verify. Same primitive for human → agent and agent → agent. Read the deep dive →

Integrate a surface

API gateways and MCP tools, voice and conversational agents, meetings, and physical systems. Same wire format everywhere. See the integration guides →

Deploy Ratify Verify

The managed control plane — hosted revocation, audit archive, policy enforcement at scale. For enterprises. Learn what Verify adds →

Three verbs, one primitive

Section titled “Three verbs, one primitive”
   DELEGATE                  PRESENT                   VERIFY
   ────────                  ───────                   ──────
   Principal signs a         Presenter (agent)         Any third party
   DelegationCert            carries the cert          runs the verifier.
   naming the subject,       and signs a fresh         Both Ed25519 AND
   the scopes, and the       challenge on every        ML-DSA-65 must
   expiration.               interaction.              verify. Yes/no
                                                       in <1ms. No trust
   Human → Agent OR          Proves "this key is       relationship with
   Agent → Agent.            live right now."          presenter required.

The same primitive works in both directions. A human delegating to their AI assistant and one AI agent sub-delegating to another use the exact same verifier algorithm and the same cryptographic guarantees.

Where Ratify sits in your stack

Section titled “Where Ratify sits in your stack”

Keep your IAM, OAuth, MCP, A2A, and policy engines — Ratify adds the missing proof; it replaces none of them.

IAM authenticates Alice → MCP moves the tool call → Ratify proves delegated authority → your API

Bearer tokens worked when a human was present, a known client called a known API, and the session stayed inside one app boundary. Agents act later, call many tools, cross vendors, and hand work to other agents — so the receiving side needs a portable, pre-action proof of who delegated authority, what scope was granted, and whether it is still valid. OAuth authenticates an account. MCP moves a tool call. Policy engines interpret rules. Ratify proves the agent had delegated authority before the action.

Quantum-safe by design

Section titled “Quantum-safe by design”

Every signature is a hybrid pair: Ed25519 + ML-DSA-65 (NIST FIPS 204). Both must verify. Bundles signed today remain unforgeable even when a cryptographically-relevant quantum computer exists.

Two products, one protocol

Section titled “Two products, one protocol”
  • The Ratify Protocol is open: spec under CC-BY-4.0, SDKs under Apache-2.0, reference verifier free for everyone. GitHub →
  • Ratify Verify is the managed operational layer for agent authorization decisions: a metered verification API, hosted revocation checks, delegation controls, and a hash-chained audit trail. The managed service is currently in alpha. What Verify adds →

You can use the open protocol forever without ever touching Verify. Verify exists for teams that want managed authorization infrastructure without operating it themselves.

Maintained by Identities AI, Inc. Ratify Protocol™ and identities.ai™ are trademarks of Identities AI, Inc. U.S. patent application pending.