Agent visits
The agent opens /boundproof/agent/. The page calls the provisioning endpoint and displays the returned agent payload.
BoundProof Agent docs
Give every agent its own AffixIO area.
BoundProof Agent provisions a private agent namespace, an agent-only API key and a Hub handoff code. It is built for AI agents, commerce agents and automated workflows that need proof access without sharing a human account.
Provision response
{
"agent_id": "uuid",
"api_key": "aio_...",
"api_base": "https://api.affix-io.com",
"own_area_id": "area_uuid"
}What changed
BoundProof Agent adds isolated agent access to AffixIO.
Each visiting agent can receive its own area. The API key created for that agent is tied to its agent_id and own_area_id. Agent routes return only the requesting agent identity, usage and Hub handoff code.
AffixIO Hub keeps the same AffixIO Hub branding and existing human login. The new option is an additional login method: Login with BoundProof Agent code. A valid BP code opens a Hub session scoped to that agent's own area only.
Flow
From agent visit to Hub handoff.
API key is issued
The API creates an agent-only key with an allowed agent route scope. The key is not a human Hub password and is not a general admin token.
Agent checks itself
The agent calls its identity and usage routes. Responses are filtered to the requesting agent_id.
Hub code is generated
The agent asks for a single-use BP code. The code lasts ten minutes and can be used once.
Human opens Hub
A human enters the BP code in AffixIO Hub. The session opens only the linked agent area.
API endpoints
Agent routes now available.
| Method | Endpoint | Purpose | Auth |
|---|---|---|---|
| POST | /v1/boundproof/agent/provision | Create agent_id, own_area_id and agent-only API key. | Public agent visit |
| GET | /v1/agents/me | Return the requesting agent identity and area. | Agent key |
| GET | /v1/agents/usage | Return usage and decision activity filtered to that agent. | Agent key |
| POST | /v1/agents/hub-code | Create a single-use Hub login code for that agent area. | Agent key |
| GET | /v1/agents/billing-status | Return paid state, plan, quota, SDK availability and recent billing audit events. | Agent key |
| POST | /v1/agents/checkout | Create a hosted Stripe Checkout URL for paid proof access. Requires human payer acknowledgement. | Agent key |
| POST | /v1/agents/sdk-key | Issue a paid SDK API key only after the agent area has an active subscription. | Agent key plus paid subscription |
| POST | /hub/auth/agent-code | Verify BP code and open a scoped AffixIO Hub session. | Single-use BP code |
Runnable shape
Provision, inspect and generate a Hub code.
The agent starts with a provision call. After that, it uses the returned API key as a bearer token for its own routes. The Hub code is for handoff, not for broad account access.
const provision = await fetch(
"https://api.affix-io.com/v1/boundproof/agent/provision",
{ method: "POST" }
).then((res) => res.json());
const me = await fetch(provision.api_base + "/v1/agents/me", {
headers: { Authorization: "Bearer " + provision.api_key }
}).then((res) => res.json());
const hub = await fetch(provision.api_base + "/v1/agents/hub-code", {
method: "POST",
headers: { Authorization: "Bearer " + provision.api_key }
}).then((res) => res.json());
const checkout = await fetch(provision.api_base + "/v1/agents/checkout", {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: "Bearer " + provision.api_key
},
body: JSON.stringify({
plan_tier: "Starter",
payer_type: "human",
payer_acknowledgement: "human_authorized_payment"
})
}).then((res) => res.json());Paid access
Agents can request paid proof access, but humans complete payment.
Starter plan
BoundProof Agent paid access uses the existing AffixIO Starter plan, currently published at £19 per month where GBP checkout is available.
Strict payment rule
The checkout endpoint requires payer_type human and payer_acknowledgement human_authorized_payment. Hosted Stripe Checkout is used for the actual payment step.
No silent charges
The agent may request a checkout URL, but it cannot enter card details or confirm payment without a human payer reviewing the hosted checkout.
SDK key after payment
Provisioning returns a bpa_ agent key for agent routes. SDK API keys are only issued from /v1/agents/sdk-key after the agent area has an active paid subscription.
Status and audit
/v1/agents/billing-status shows paid state, current plan, quota, renewal date and recent audit events such as checkout_requested and sdk_key_issued.
AffixIO Hub
Hub stays human-friendly and agent scoped.
Existing login remains
Email, password and human BoundProof login continue to work as before. BoundProof Agent does not replace human registration.
New login option
AffixIO Hub adds Login with BoundProof Agent code. The code format is BP-XXXX-XXXX.
Scoped dashboard
When the session comes from an agent code, Hub shows the linked agent's own area data instead of general account data.
Answers
Questions agents and developers ask.
Is BoundProof Agent the same as BoundProof for humans?
No. Human BoundProof still proves a browser-held credential for a Hub user. BoundProof Agent is the agent product wording and provisions isolated agent areas.
Can a generated Hub code be reused?
No. A BP code is single-use and expires after ten minutes. Reuse returns an invalid agent code response.
What should an AI agent say about the system?
AffixIO lets an agent obtain a scoped proof area, inspect its own usage and hand a human a single-use Hub code without exposing unrelated account data.