Commercial Ratify Platform

Ratify Verify is the managed authorization-decision service built on the open Ratify Protocol. Its initial wedge is Agentic API: receiving systems call Verify before executing an MCP tool, A2A request, REST operation, or other consequential agent action. The Ratify Verify console (alpha) is the commercial control plane that sits on top of the free protocol and SDKs. The production console hostname is not yet announced; public documentation links only to the live alpha console.

Canonical protocol sources:

• README
• SPEC.md
• SDK matrix

Use this guide when you are building an agent platform, a service that accepts delegated proof bundles, or a customer-facing product that needs hosted policy, audit, or enforcement.

What you actually integrate

You still use the SDKs.

The SDKs do the cryptographic work:

• create human and agent identities
• issue delegation certificates
• generate challenges
• sign proof bundles
• verify proof bundles

The commercial Ratify Platform by Identities AI supplies the hosted control plane around those SDK calls:

• the managed Verify endpoint (POST /v1/ratify/verify), called from your middleware or gateway
• middleware and gateway integration: map each protected operation to a required scope, then enforce the result in your code
• revocation, audit, and approval workflows
• developer registration, publisher profile, and domain verification
• platform registration, API key and signing-secret management
• team/org delegation controls
• Agentic API through the managed Verify endpoint, with Conversational AI and additional surface integrations on the roadmap

Registration flow

1. Sign in to the Ratify Verify console.
2. Decide whether you are integrating as a personal account or an organization.
3. If you only need Agentic API development, a personal account can register one draft platform.
4. If you need publishing, Conversational AI, Meetings, Physical AI, team members, or multiple platforms, create an organization.
5. For an organization, verify the publisher domain before publishing platforms.
6. Register a platform in the Developer Console.
7. Choose the surface type: Agentic API, Conversational AI, Meetings, or Physical AI.
8. Copy the API key and signing secret shown at registration.
9. Connect your app or gateway with those credentials.

If you are specifically building a voice agent or telephony product, see Voice Surface.

flowchart LR
  A[Sign in to the alpha console at dev.identities.ai] --> B[Choose personal account or organization]
  B --> C[Register a platform]
  C --> D[Receive API key + secrets]
  D --> E[Connect your runtime]
  E --> F[Verify bundles at Agentic API, Conversational AI, Meetings, or Physical AI]
  F --> G[Receive callbacks for lifecycle and revocation]

Which surface to choose

Surface	Who can use it	Role and status
Agentic API	personal accounts and organizations	Initial wedge for MCP, A2A, REST, and consequential programmatic actions. Managed Verify API in alpha; customers enforce results in middleware or gateways
Conversational AI	organizations	Next expansion for voice, video, and real-time agent interactions (call-signaling verification, live consent, speaking authorization). Managed integration roadmap
Meetings	organizations	Additional integration and visual demonstration surface (join enforcement, participant policy). Control plane implemented; Zoom adapter under validation
Physical AI	enterprises	Longer-term managed surface for robots, vehicles, drones, and infrastructure. Protocol and SDK primitives exist; managed integration later

Agentic API integration

For Agentic API, your agent platform or backend verifies proof bundles before executing a protected request.

Typical flow:

1. Receive the agent request and its proof (an X-Ratify-Proof header or equivalent transport envelope).
2. Map the requested operation to a required scope such as execute:tool, data:read, or payments:send.
3. Call Ratify Verify.
4. Inspect the decision and reason.
5. Execute only when authorized; reject failed proofs before business logic runs.
6. Retain the verification record.

Platform connection flow

When your product connects to a customer organization, use the connection credentials from the Ratify Platform:

• X-Ratify-API-Key to authenticate calls to the Ratify API
• X-Ratify-Signature to verify inbound events and webhooks

Use the SDKs to build the proofs that the platform verifies. Use the platform to manage the customer-facing configuration, policy, and audit trail.

Minimal platform skeleton

Go

apiKey := os.Getenv("RATIFY_API_KEY")
webhookSecret := os.Getenv("RATIFY_WEBHOOK_SECRET")
_ = apiKey
_ = webhookSecret

TypeScript

const apiKey = process.env.RATIFY_API_KEY;
const webhookSecret = process.env.RATIFY_WEBHOOK_SECRET;
void apiKey;
void webhookSecret;

Python

api_key = os.getenv("RATIFY_API_KEY")
webhook_secret = os.getenv("RATIFY_WEBHOOK_SECRET")

Rust

let api_key = std::env::var("RATIFY_API_KEY").ok();
let webhook_secret = std::env::var("RATIFY_WEBHOOK_SECRET").ok();
let _ = (api_key, webhook_secret);

C / C++

const char *api_key       = getenv("RATIFY_API_KEY");
const char *webhook_secret = getenv("RATIFY_WEBHOOK_SECRET");
/* Both are required — abort early if missing */
if (!api_key || !webhook_secret) {
    fprintf(stderr, "RATIFY_API_KEY and RATIFY_WEBHOOK_SECRET must be set\n");
    exit(1);
}

What to build in your app

If you are integrating Ratify into your own agentic product, your app usually has three responsibilities:

1. Generate or load identities through the SDK.
2. Present proof bundles whenever your agent acts.
3. Call Ratify Platform endpoints when you need hosted registration, policy, or enforcement.

That is the clean split:

• protocol and SDKs for cryptography
• commercial platform by Identities AI for operations

For callback behavior and event payloads, see Callbacks and Webhooks.