Ask how an AI agent authenticates today and the honest answer is usually a borrowed key: a shared API key, a service account, or a token from someone's login. Whoever holds it is the agent. A key copied from a log, a repository or a disk works for anyone who holds it, from any machine, and nothing about the request proves who is actually using it.
The fix is proof of possession: make every call carry a fresh signature that only the real agent can produce.
A token that is not a bearer credential
Oathera's identity token lasts 120 seconds by default and names a new session key held only in memory. A token sent straight to a service as a bearer credential is refused; a token without its session key is refused. The token is not the thing that authorizes the call. The proof is.
A single-use proof on every call
Every operation carries an operation proof, signed with the session key over the operation, its arguments and the token. It is single use. Replay the same proof and it is refused. Change an argument after signing and it is refused. Steal the token and you still cannot act, because you do not hold the session key that lives in the agent's memory. Audience-bound tokens name one service and last at most 300 seconds, or 60 seconds for privileged capabilities.
Why short-lived tokens are not the whole story
Shortening a token's life helps, but a credential anyone can replay is still replayable for its whole lifetime. Proof of possession removes the bearer property entirely: there is nothing to replay and nothing to lift, because each call must be freshly signed by a key that never leaves the agent. The Identity MCP signs proofs for the sample tools in the MCP bundle, and the Gateway MCP verifies proofs for any tool the company configures.
How Oathera helps
Oathera gives every AI agent an identity bound to the machine it runs on, approved by a named person, and checked every time it acts. Proof of possession is how the "checked every time it acts" part holds up under a stolen token or a replayed request. It uses open standards: JWT and JWS with EdDSA, RFC 7800 for the confirmation key, RFC 7638 for the key digest, and RFC 9421 for Oathera's own HTTP calls. Oathera works with your identity provider and is the identity layer under your IAM and AI governance, not a replacement for them.
See it, or build it with us
Watch a stolen token fail, a replayed proof get refused and a tampered call get caught, in the simulator at sim.oathera.org. Our first design partners start in early November 2026. If you are putting agents into production, become a design partner.
Every AI agent, sworn in.