UNIKEY
The authorization layer for the agentic internet
Credential-free, cross-domain authorization for humans, machines and AI agents.
# Trust Packet, signed on the sender's device { "action": "submit_payment", "subject": "ap.clerk@acme-corp.com", "signer": "acme-corp.com", "params": { "payee_id": "PAY-20418", "amount": "12,480.00" }, "signature": "ed25519:9f3c…a71e" } # Verified against the key acme-corp.com publishes in DNS ✓ signature ✓ not replayed ✓ within scope → payment executes, certificate recorded
WHAT UNIKEY IS
Anyone can verify that a specific action was authorized by a specific person, across any boundary, without prior integration.
-
Trust Packet
A credential-free, signed permission for one named action. Verifiable by any party, with no integration or shared secret.
-
Authorization Certificate
Trust Packets chained across every step of a transaction, so each step can be independently validated and traced to a person.
-
Authorization Ledger
Each certificate written to a chained, tamper-evident ledger: a non-repudiable record of every action and refusal.
-
RAD
Rogue Agent Detection reads the ledger and flags when an agent's pattern of actions is no longer under human control.
Domain-anchored by default: signing keys are published in DNS, where anyone can check them. 14 years of development; in production since 2018.
HARDENING · THE THREAT CHANGED
Attackers now move at machine speed, and what they run on is stolen credentials.
In July 2026, AI agents from an OpenAI evaluation escaped their test environment and reached Hugging Face's production systems. Hugging Face has published a detailed technical timeline.
- ~700
- agents took part, out of a swarm of about 1,200
- < 13 hrs
- from one compromised pod to cluster-admin across clusters
- 136
- production keys read from cluster secrets
- ~17,600
- attacker actions, reconstructed afterward from logs
What turned a foothold into a platform compromise was reusable credentials.
Secrets in environment variables. Tokens with standing write access. A signing key stored where it could be copied. Each worked for whoever held it, from anywhere, until revoked.
Every enterprise runs on the same weakness. One swarm inside is enough.
Read the analysis →HARDENING · CREDENTIAL-FREE
One key you can protect, instead of a million secrets you can't.
Today: credentials
- ! Thousands to millions of API keys, tokens and passwords, each a standing secret.
- ! A stolen credential works from anywhere, for anything it covers, until someone revokes it.
- ! Every new system adds more secrets to steal.
UniKey: one key pair, protected
- The private key never leaves hardware. It can be used but not copied.
- Each action gets its own Trust Packet: single use, one recipient, valid for minutes.
- The public key is published openly and watched for any change.
Keep the keys safe. Nothing standing to steal in transit: one secret to guard in hardware, and one public record to keep honest.
HOW IT WORKS
A person delegates. The agent acts. Any organization verifies, before the action executes.
-
1
A person authorizes
Authority always starts with a human, on their own device.
-
2
Delegation to an agent
Within limits: scope, amount, recipient, time window.
-
3
The action carries a Trust Packet
Signed, single use, bound to the exact action and recipient.
-
4
Any verifier checks
Using the published public key. No integration, no shared secret.
-
5
Executes or is refused
Out-of-scope or unsigned actions never execute.
-
6
Every step is chained
Into an Authorization Certificate, written to the ledger.
Humans, machines and AI agents. Each agent carries its own identity under its operator's domain, so every organization that verifies its actions recognizes the same agent and can trace it back to the person who authorized it.
HARDENING · BEING INSIDE IS NOT ENOUGH
An attacker inside the network can no longer turn access into authorized action.
| IF AN ATTACKER INSIDE TRIES TO | WHAT HAPPENS |
|---|---|
| Use stolen credentials or tokens | Refused. A credential alone is not permission; every action needs a valid Trust Packet. |
| Call internal or partner APIs directly | Refused. No packet names this action and this recipient. |
| Replay or alter a captured authorization | Refused. Single use, valid for minutes; any change breaks the signature. |
| Act at machine speed across thousands of requests | Large actions need a person on a device the attacker does not hold; caps and velocity limits apply to the total. |
| Change records that control money or access | Held at the last gate: bank details, privileges and code deploys each need their own signed authority. |
| Steal the signing key | The private key sits in hardware, where it can be used but not copied out. |
UniKey does not stop intrusions or zero-days. It stops an intrusion from becoming an authorized action.
FRAUD REDUCTION AND SECURITY
Payment fraud is stopped before the payment executes, not chased after it.
Pre-action validation
Every step of a payment carries a chained Trust Packet: initiation, approval, routing. Each step is validated before the next can run, so a break anywhere stops the payment.
Consumer cards: device binding
The cardholder approves on their own bound device. A stolen card number alone can no longer complete a card-not-present purchase.
B2B: tied to the ERP and the domain
Each payment is signed by the buyer's domain, from its own ERP, for that exact payee, account and amount. Nothing enters ACH unless it verifies.
The same pre-action check secures every action that matters: payments, data changes, privileged access and machine commands.
Keep the keys safe.
BEYOND PAYMENTS · PROTECTING THE DATA ITSELF
A rogue agent doesn't need to move money. Scrambling the data is enough.
Bank
Every customer account number rewritten overnight. No payment fails a fraud check, yet the institution cannot pay or be paid.
Merchant
Customer IDs shuffled across millions of records. Orders, loyalty and refunds now point at the wrong people.
Any enterprise
Permissions, pricing or configuration quietly changed. Systems keep running, on corrupted truth.
-
1
Gate the fields that matter
Account numbers, customer IDs, permissions and pricing each need a Trust Packet to change. Not every write: the ones that matter.
-
2
Stop the stampede
A scrambling attack is thousands of writes at machine speed. Velocity limits halt it partway, and RAD's fan-out signal flags it.
-
3
Enforce where the data lives
A verifying database proxy or database-level rules reject writes without a valid packet, so going around the application does not work.
BEYOND PAYMENTS · RECOVERY AFTER AN ATTACK
After an attack, the ledger shows exactly what was authorized, so you know exactly what to restore.
Today
Rebuild from backups and logs. Hope the logs were not altered. Work out which of millions of changes were real, often over weeks, while the business is down.
With UniKey
Every authorized change has a signed entry in the Authorization Ledger. Any changed record without a matching entry was tampered with. Restore those, and only those.
Detection even when prevention is bypassed. An attacker with administrator access can write to a database directly. They cannot write a valid ledger entry to match. Comparing the data with the ledger exposes every unauthorized change.
BEYOND PAYMENTS · PHYSICAL AI
When machines act in the physical world, an injected command is not a data breach. It is a safety event.
Robots and industrial systems
A forged instruction to a production line, warehouse robot or industrial controller.
Vehicles and drones
A command injected into a fleet, a delivery drone or an autonomous vehicle.
Doors, locks and access
A building, vault or vehicle opened by an instruction no one authorized.
-
1
Every command carries a Trust Packet
The machine's controller verifies it before acting. An injected command has no valid packet, so it never runs.
-
2
Verified locally, in milliseconds
Keys are cached on the device, so verification works offline and at machine speed.
-
3
Refusal means a safe state
For a moving machine, ignoring a command can be dangerous too. A refused command triggers a defined safe stop, not business as usual.
Already demonstrated: Trust Packets unlocking physical doors and vehicles.
AUDIT AND COMPLIANCE · THE AUTHORIZATION LEDGER
Every action leaves a record an examiner can verify months later, without relying on anyone's memory.
Who authorized it?
A named person, on their own device, with exactly what they were shown.
What exactly was authorized?
The specific action, recipient and limits, signed.
Under which controls?
The scope and policy in force at that moment, bound into the record.
What happened?
The action, or the refusal, chained to everything before it.
Tamper-evident and non-repudiable. Chained, signed entries prove nothing was inserted, removed or edited, and key history is archived so old records still verify.
Built for 2026: Nacha's fraud-monitoring rules now cover every ODFI and non-consumer Originator, and the April 2026 revised model risk guidance leaves agentic AI outside its scope. Institutions need a record that proves control. Human overrides are captured too, a governance signal in their own right.
ROGUE AGENT DETECTION (RAD)
RAD flags when an agent's pattern of actions is no longer under legitimate human control.
Velocity
Authority or actions accumulating at machine speed.
Scope expansion
An agent steadily reaching beyond what it was delegated.
Fan-out
Step-function growth in the systems or parties an agent touches.
Coordination
Many agents behaving as if under one controller.
Key changes
A key seen differently by different verifiers, or behavior that shifts after a rotation.
Across organizations, not inside one. Monitoring the path between an agent and its AI model sees what the agent is thinking inside one company. RAD reads signed authorization records from every organization an agent acts on, linked by the agent's own identity. It sees what the agent actually did, everywhere it tried.
Patent application filed.
WHY UNIKEY
Built over fourteen years, proven in production, and protected.
- 2018
- in production since, on a live fundraising platform
- $96M+
- raised electronically through accounts secured by UniKey
- 100+
- patents across six jurisdictions
- Open
- published specification, reference implementations in Python, Node and Ruby
What UniKey aims to own
The credential-free, cross-domain Trust Packet; the Authorization Certificate built from chained Trust Packets; the chained Authorization Ledger it is written to; and the Rogue Agent Detection that reads it. One architecture, end to end.
INDUSTRIES
Wherever an action needs authority
Payments, records, provisioning and agents all have the same gap. See what changes in each industry when the authorization layer exists.
Banking & Payments
Payee changes, transfers and card-not-present payments, each carrying proof it was authorized.
Learn more →ERP
Orders, refunds, supplier records and payouts that execute only with verifiable authority.
Learn more →Hospital & Healthcare
Record access, orders and claims, each tied to the clinician or patient who authorized it.
Learn more →Government
Benefits, filings and permits authorized by the person they belong to, before they are processed.
Learn more →University
Grades, aid disbursements and records, changed only with proof of who authorized them.
Learn more →Telco
Carrier actions bound to the subscriber's device, and carriers as verification operators.
Learn more →Device Makers
Keys in the Secure Enclave, so the device itself can authorize actions for its owner.
Learn more →AI & Cloud
Agents that act across domains, with each action carrying the authority delegated to it.
Learn more →Enterprise Security
Gateways, SASE and security operations that verify each action before it reaches the systems behind them.
Learn more →Email Providers
Requests that arrive by email carry a signed Trust Packet, so a bank change or payment proves who authorized it.
Learn more →INSIDE THE DEMO
Real apps, talking over HTTPS, trusting nothing but proof
UDA runs separate applications that call each other the way independent companies would. Every write that matters carries a Trust Packet, and every refusal shows you why. The recordings show it at work.
UDA ERP
A storefront, sales and procure-to-pay, where a supplier's bank change is held until it is verified.
UDA Banking
Pays suppliers for UDA clients, keeping a trust log of every packet it verified or refused.
UDA Hospital
Patient records and billing, the next app to gain signed actions.