Security and JWKS

Last updated: 25 September 2026

/.well-known/jwks.json is not a “secret door”. It contains a public key; not the key to a locked vault, but the public document that says how the lock is verified.

Why it exists

The agent asks for get_credential over MCP. The platform mints a 60-second JWT. The company learns that this JWT really came from AgentGunes in two ways:

1. Recommended: POST /api/agent/verify — signature + one-time use + company/agent match + agent not stopped, all checked on our side.
2. Optional local check: you only look at the signature with the public key in JWKS. Replay and “agent stopped” checks are not in JWKS.

Address

Live: https://www.agentgunes.com/.well-known/jwks.json

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "public-key-in-base64url",
      "use": "sig",
      "alg": "EdDSA",
      "kid": "platform-ed25519"
    }
  ]
}

• kty: OKP — octet key pair (Ed25519 family).
• crv: Ed25519 — the curve.
• x — the public key itself (the lock template).
• use: sig / alg: EdDSA — for signatures.
• kid — which key; it matches the kid in the JWT header.

What is in the JWT?

• iss — who minted it: the platform APP_URL (e.g. http://localhost:8080). It should match the place you downloaded JWKS from.
• aud — which company: your slug.
• sub — which agent.
• exp — trash after 60 seconds.
• jti — one-time id. Verify marks it once; a repeat is 401 replay.
• cnf.jkt — fingerprint of the agent public key. A stolen JWT cannot be used with another key.

Sign-in and account

• Sign-in: 5 attempts per minute for the same email and IP, 20 for the same IP. After that it locks briefly.
• Registration: 5 per minute for the same IP.
• Forgot password: 3 per minute for the same IP. Password reset: 5 per minute.
• The session cookie is HttpOnly and SameSite=Lax. On HTTPS the Secure flag must be on.

Blocks, stop, approval

• If the account or agent blocked the company, no new token is minted. Verify does not reject the JWT already in hand because of that user-side block; lifetime and one-time use are enough.
• If the company blocked the account from Incoming agents, none of that account’s agents can mint a new token, and an in-hand JWT is rejected at verify. The block fires the company’s deletion URLs.
• Stopping the agent cuts new tokens and verify.
• The MCP token is identity only; it does not grant permission by itself.
• “Allow fully” skips the approval card. High risk is not asked either.

Do not

• Do not use JWKS as an “access token”. The company API wants Authorization: Bearer agk_…; that token comes from POST /api/company/token.
• Do not treat the x value in JWKS as secret. Being public is by design.
• Do not invent your own JWKS and pretend to be the platform; the signature will not hold without the private key.
• API docs load from this site. Opening them while signed in gives that tab same-site request authority. Open docs signed out.

Company API summary: /docs/api. Getting an access token: POST /api/company/token (domain + hidden password).

This text explains how AgentGunes works; it is not legal advice. Questions go through the contact email on your panel account.