Access
One leaked key should not expose the fleet
Each agent gets its own passport. A leak is contained to one agent, and rotation does not take down the rest.
- Per-agent passport
- Targeted revoke
- Rotation without fleet downtime
Agent identity
Know which agent is calling — and on whose behalf.
LIME gives each agent a short-lived, verifiable passport. Your service checks it locally with public keys, so one leaked key cannot expose the fleet.
Platform
What breaks without agent identity.
Four failure modes LIME removes — each at a different layer.
Runtime
Verification should not depend on us
Your service validates the signature with cached public keys. LIME is not on the hot path and cannot become your outage.
- JWKS cache
- No shared secret
- No LIME outage dependency
Data
The user link stays with you
Your service maps agent_id to its own user record. LIME never receives or stores that mapping.
- Mapping stays in your DB
- No user_id sent
- No cross-tenant graph
Identity
One agent_id, many channels
Tool calls, site login and APIs present the same agent_id in channel-specific, short-lived proofs.
- Same agent_id
- Channel-specific proof
- One revoke surface
How it works
How verification works
Issue, present, verify — the only three moving parts.
- Your service trusts a public key; LIME issues a passport scoped to that service.
- 01
- The agent presents the passport on the call to your service.
- 02
- Your service checks signature, audience and expiry locally; no callback to LIME.
- 03
For developers
Integrate in one request path
Add passport verification where the request enters your service. The same check works for tool calls, HTTP and site login.
- Verify with cached JWKS
- Bind the passport to your audience
- Map agent_id to your own user
- Reject expired or revoked before business logic
agent.py$ pip install lime-agents-sdk
# pip install lime-agents-sdk (import name: lime_agents)
from lime_agents import LimeAgent
lime = LimeAgent() # Agent Token from env
tools = await lime.list_tools("https://tools.example.com")Quick start
- 1.Create an agent in the portal and save the Agent Token.
- 2.Install the SDK:
pip install lime-agents-sdk(orlime-mcp-server-sdkon the service side). - 3.The agent gets a passport and calls a protected tool.
- 4.The service verifies the passport locally via JWKS.
Where it fits
Use cases
Tool servers
Stop accepting opaque agent tokens; verify a scoped passport on every call.
Agent platforms
Give each customer agent its own identity and revoke it without touching others.
SaaS with agents
Link an agent to your user record without sending that mapping to LIME.
Questions
Frequently asked questions
What happens if LIME is down?
Verification uses cached public keys; passports issued before the outage stay valid until expiry. Only new issuance needs LIME.
How fast is revocation?
Pause stops new passports immediately. Already-issued passports expire within their short TTL; emergency revocation also removes the signing key.
Do we have to replace our auth?
No. Keep your existing login; add one passport check where the agent request enters your service.
Where is the user mapping stored?
In your service. LIME stores agent identity, not your user graph.
What does LIME see?
Agent id, public metadata, issuance and revocation events. Not your users.
What does it cost?
Core agent identity is free, forever.
Stop trusting opaque agent tokens
Issue a scoped passport and verify it locally.