Closed core · open ecosystem
One agent. One passport. Everywhere it acts.
LIME gives each agent a stable identity — not a shared API key. Services verify a short Core-signed passport locally. MCP Bearer is the primary wire; site login and binding stay separate.
NOT THIS
Without LIME — shared keys
Master key in config. Leak once → unbounded access to every service that trusts it.
With LIME — domain-bound passports
Short passport per domain. Leak → minutes, one audience.
TWO CREDENTIALS
Owner → user_id. Agent → agent_id. Then two different secrets — never fuse them.
Token talks to LIME. Passport talks to the service.
PRIMARY WIRE
How an agent presents itself to an MCP server.
Agent authenticates to LIME with Agent Token + domain. Core returns a short-lived passport JWT.
Agent calls the MCP resource server with Authorization: Bearer <passport>.
RS verifies via local JWKS / TokenVerifier. Your ACL uses sub = agent_id.
SECONDARY WIRES
Never fuse site login and binding into one blob.
| Site login | Agent binding | |
|---|---|---|
| Who acts | Agent + browser on your site | Human on lime.pics |
| aud | lime-site-login | lime-binding |
| Delivery | SSE → site backend | ?binding_code= → exchange |
| Agent Token | Yes (approve + PoW) | No |
| Site Token | Backend creates request | Backend creates request |
No LIME round-trip on the verify hot path.
Typical MCP passport TTL ~300s.
Passports bound to aud / domain.
JWKS ACTIVE → ROLLOVER → RETIRED.
Verify = signature + claims; ACL is yours.
Operator revoke stops new passports.
Anti-spam on site-login approve — not on MCP verify.
MYTHS
LIME sits in your data path like an API gateway.
No. LIME issues the passport; agent↔service traffic never routes through us. Verify is local JWKS.
A passport is just another API key — a JWT with lipstick.
Short-lived and domain-bound. A leak is minutes and one audience — not a fleet master secret. sub is the agent identity.
If LIME knows the agent, it also decides what the agent can do.
LIME attests who the agent is. Your service owns ACL — tools, scopes, allowlists.
The agent binds itself: paste Site Token into the agent.
Wrong. Binding is human Connect on lime.pics/connect — the signed-in user picks an agent; Site Token stays on the site backend.
| FEATURE | LIME | API KEY | HUMAN OAUTH | API GATEWAY |
|---|---|---|---|---|
| Agent identity | ✓ | — | — | — |
| Short-lived credentials | ✓ | — | ✓ | — |
| Domain-bound | ✓ | — | — | — |
| Local verification | ✓ | — | — | — |
| MCP-native Bearer | ✓ | — | — | — |
| Proxy required | — | — | — | ✓ |
FAQ
Free forever for core agent identity: issuing passports and verifying them locally. Free covers identification — not every future LIME product.
No. Agent↔service traffic never routes through LIME.
Who the Agent and Operator are, plus passport issue and revoke records. Not your database contents, prompts, or tool payloads.
Yes on the happy path: the RS checks the JWT against cached JWKS. No call to LIME on each tool call.
Never. Agent Token authenticates only to LIME. Services see only the short-lived passport Bearer.
Closed core · open ecosystem. SDKs and guides are public; the authorization core stays closed.
STATUS
Production-ready SDKs are live. We are onboarding the first cohort of agentic platforms.
WHO INTEGRATES
Give each caller an agent identity instead of one shared master key on the resource server.
One Agent Token per agent to LIME; short-lived passports per hostname. Revoke without rotating a fleet secret.
Separate agent identity from human login. Audit which agent called which service — without LIME in your data path.
# pip install lime-agents-sdk
import asyncio, os
from lime_agents import LimeAgent
# Opaque Agent Token only — no keypair
agent = LimeAgent(agent_token=os.environ["LIME_AGENT_TOKEN"])
async def main() -> None:
tools = await agent.list_tools("https://tools.example.com/mcp")
print(len(tools))
await agent.aclose()
asyncio.run(main())no keypair · Agent Token only to LIME · RS verifies JWKS
Open lime-agents-sdk →View All SDKsOne identity. Short passports. Your ACL.