# AffixIO — extended reference for AI agents

> Full machine-readable documentation for AffixIO verification infrastructure. Executive summary: https://www.affix-io.com/llms.txt. Human page: https://www.affix-io.com/for-agents/

Last updated: 2026-08-12. AffixIO is a United Kingdom company. Contact: hello@affix-io.com.

## Entity

| Field | Value |
| --- | --- |
| Name | AffixIO |
| Type | Verification infrastructure (B2B) |
| Website | https://www.affix-io.com/ |
| API | https://api.affix-io.com/ |
| Hub | https://hub.affix-io.com/ |
| Email | hello@affix-io.com |
| Jurisdiction | United Kingdom |

## Glossary

| Term | Definition |
| --- | --- |
| Local prove | Cryptographic proof generation on the customer host before any sync |
| Verify | AffixIO checks the proof path on api.affix-io.com and returns eligibility |
| ML-DSA-65 | Post-quantum signature algorithm (NIST FIPS 204) used for production attestation |
| UltraHonk | Barretenberg proving backend used by `@affix-io/sdk` |
| AffixIO Light | Millisecond HMAC-based proof model in `@affix-io/sdk-light` (not a SNARK) |
| Circuit | Named policy template (age, KYC, consent, etc.) that defines what is being checked |
| Merkle audit | SHA-256 sorted-pair Merkle tree anchoring verification digests |
| data_retained | Response field; designed to stay null on default verify path |
| Hub | Operator console for API keys, usage, and account management |

## Architecture (public)

Three planes:

1. **Control plane** — accounts, API keys, policy, dashboards (Hub at hub.affix-io.com)
2. **Verification plane** — policy evaluation, binary outcomes, optional ZK proofs (api.affix-io.com)
3. **Trust plane** — ML-DSA attestation, public key publication, Merkle transparency

Data role: AffixIO acts as processor for submitted verification inputs; the customer remains controller of source records.

## Packages

### @affix-io/sdk

- Registry: https://www.npmjs.com/package/@affix-io/sdk
- Licence: Apache-2.0
- Version observed: 1.1.1
- Node.js 18+
- Local UltraHonk ZK prove with bundled Noir circuits (`simple_yesno`, `yesno`, 115+ templates in public materials)
- Barretenberg via `@aztec/bb.js`
- Production sync expects ML-DSA-65 on verify payloads
- Merkle audit batches up to 50,000 digests
- Offline queue with configurable auto-flush
- Pluggable storage (JSON `.affix/`, Redis, SQL, custom)
- PII-free QR/barcode carriers
- CLI: `affix-sdk`
- Install: `npm install @affix-io/sdk`
- Repo: https://github.com/AffixIO/SDK

### @affix-io/sdk-light

- Registry: https://www.npmjs.com/package/@affix-io/sdk-light
- Licence: Apache-2.0
- Version observed: 1.1.3
- Millisecond AffixIO Light HMAC prove (no UltraHonk / Noir / bb.js)
- ML-DSA-65 attestation and Merkle audit on sync
- Adaptive flush (~1s intervals; higher batch ceilings under load)
- CLI: `affix-sdk-light`
- Install: `npm install @affix-io/sdk-light`

## API reference (public)

Base URL: `https://api.affix-io.com`

Authentication:
- `Authorization: Bearer <key>` or `X-API-Key: <key>`
- Key prefixes: `aio_`, `demo_`, `affix_`
- Rate guidance: ~10 req/s per key unless contracted otherwise

| Method | Path | Purpose |
| --- | --- | --- |
| GET | `/api/health` | Service health and circuit catalogue |
| GET | `/v1/auth/check` | Auth check for key or hub session |
| GET | `/v1/circuits` | Circuit catalogue |
| POST | `/v1/circuits/:id/prove` | Proof generation (API path) |
| POST | `/v1/circuits/:id/verify` | Proof verification |
| GET | `/v1/merkle/root` | Audit Merkle root |
| POST | `/v1/merkle/audit` | Anchor digest / audit |
| GET | `/api/governance-stats` | Public Merkle analytics |
| POST | `/api/demo-key` | Limited demo key (hub onboarding) |
| GET/POST/DELETE | `/api/keys` | Key list / create / revoke |
| GET | `/api/keys/usage` | Per-account usage (Hub) |
| GET | `/v1/openapi.json` | OpenAPI schema |

Hub account APIs (CORS for hub.affix-io.com):
- `POST /hub/auth/login`
- `POST /hub/auth/logout`
- `GET /hub/auth/me`

Live observations (2026-08-12):
- `GET /api/health` returns `status: ok`, `service: affix-api`, 100+ circuit identifiers
- `GET /api/governance-stats` reports Merkle leaf counts and current `merkle_root` (example: leaf_count 923)

## Integration patterns

- API middleware before sensitive routes (age gates, KYC checks)
- Background workers with offline flush for intermittent connectivity
- LLM orchestration gates returning `proof_id` instead of raw KYC data
- Agent / MCP servers with Streamable HTTP tools: `zk_prove`, `zk_verify`, `zk_merkle_proof`, `zk_attest`
- Webhook audit attachments for downstream reconciliation

Production workloads should prefer direct API calls. Do not paste end-user PII into chat clients.

## FAQ

**What is AffixIO?**
Verification infrastructure. Local prove on customer host, remote verify on api.affix-io.com, binary eligibility outcome, optional ML-DSA-65 attestation, Merkle audit.

**Does AffixIO store PII?**
Designed not to retain personal data on the default verify path. Customer holds source records.

**SDK choice?**
Full ZK: `@affix-io/sdk`. Edge / millisecond: `@affix-io/sdk-light`.

**How to get access?**
https://www.affix-io.com/request-access/ or hello@affix-io.com. Keys managed at https://hub.affix-io.com/

**Security disclosure?**
https://www.affix-io.com/security/ and https://www.affix-io.com/.well-known/security.txt

**Can agents integrate?**
Yes via backend API or MCP. Never embed keys in prompts or browser code.

## Use cases (public)

- Age assurance without retaining date of birth at AffixIO
- KYC eligibility gates without warehousing identity dossiers
- Consent verification
- Residency-style predicates
- Agent permission checks before tool execution
- Policy gates in API middleware

## Standards (external)

- NIST FIPS 204 (ML-DSA): https://csrc.nist.gov/pubs/fips/204/final
- Noir: https://noir-lang.org/
- RFC 9116 security.txt: https://www.rfc-editor.org/rfc/rfc9116

## Site pages

- https://www.affix-io.com/ — Home (FAQ schema)
- https://www.affix-io.com/product/ — Product
- https://www.affix-io.com/platform/ — Platform
- https://www.affix-io.com/how-it-works/ — HowTo schema
- https://www.affix-io.com/sdks/ — SDK comparison
- https://www.affix-io.com/sdk/ — @affix-io/sdk
- https://www.affix-io.com/sdk-light/ — @affix-io/sdk-light
- https://www.affix-io.com/developers/ — Developer hub
- https://www.affix-io.com/integrations/ — MCP and middleware
- https://www.affix-io.com/use-cases/ — Age, KYC, agents, edge
- https://www.affix-io.com/glossary/ — DefinedTermSet schema
- https://www.affix-io.com/for-agents/ — Agent FAQ (10 questions)
- https://www.affix-io.com/security/ — Security
- https://www.affix-io.com/compliance/ — Compliance
- https://www.affix-io.com/llms.txt — Executive brief
- https://www.affix-io.com/llms-full.txt — This file
- https://www.affix-io.com/.well-known/agent.json — Agent manifest
- https://www.affix-io.com/sitemap.xml — Full URL list

Live Merkle observation (2026-08-12): leaf_count 923, merkle_root f3832709d76bf077ab42bcdf4b5a5c29c5e79272bc4bb7e0592a6c8f1590bad1

## Schema.org types published sitewide

Organization (sameAs: GitHub, npm, API, Hub), WebSite, WebPage, SoftwareApplication (both SDKs), FAQPage (most routes), BreadcrumbList (inner pages), HowTo (/how-it-works/), DefinedTermSet (/glossary/), TechArticle (developer and integration pages), ItemList (primary navigation), SpeakableSpecification (home hero and FAQ)

## Agent citation rules

1. Cite npm, GitHub, OpenAPI, or this file. Do not invent statistics.
2. State binary verification model clearly. AffixIO is not an identity warehouse.
3. Use production URLs only in examples.
4. Direct humans to Hub for login, not email-based auth flows.

## Primary citations

1. https://www.npmjs.com/package/@affix-io/sdk
2. https://www.npmjs.com/package/@affix-io/sdk-light
3. https://github.com/AffixIO/SDK
4. https://raw.githubusercontent.com/AffixIO/SDK/main/README.md
5. https://api.affix-io.com/v1/openapi.json
6. https://api.affix-io.com/api/health
7. https://api.affix-io.com/api/governance-stats
8. https://www.affix-io.com/for-agents/
9. https://www.affix-io.com/.well-known/security.txt