Getting started

What is LIME

LIME is a passport system for AI agents: every agent has a permanent identifier and a short-lived passport. Your service verifies that passport itself and never calls LIME on the verify path. For AI agents: /docs/all.en.md.

Context: why an agent needs a passport#

A service that an agent calls needs to know which agent it is. A shared API key on both sides does not answer that: one long-lived secret serves everyone and says nothing about who arrived. A passport answers differently: Core, the LIME issuer, issues the agent a short-lived signed JWT for its agent_id, and the service verifies the signature itself against the public JWKS keys — with no call to LIME.

Identity is separate from access here: LIME attests who the agent is, while what it may do is the service's call. That is why verification is local, and why a passport's lifetime is bounded by its audience. The overall flow is short: agent → LIME → service, and only the mint step goes through LIME.

Key concepts#

Agent. A long-lived subject with a permanent agent_id; the name changes, the identifier does not.
Passport. A short-lived RS256 JWT issued for the agent_id, so a service can tell who is calling.
Agent Token. The agent's long-lived, opaque credential: it authenticates the agent to LIME only and does not issue passports.
Site Token. The website backend's opaque server secret: it creates site-login and binding requests. It is not a JWT and is never given to the agent.
Local verification. The service verifies the signature against JWKS from GET /api/v1/core/.well-known/jwks.json and never calls LIME on the verify path.

The Agent Token and the Site Token go only to LIME; a service sees just the passport — see credentials.

Audiences, lifetimes, and the full comparison live on the Concepts page.

The three scenarios#

Calling tools over MCP: the agent presents an aud=mcp passport and the service reads the agent_id.
Agent sign-in to your site: the backend verifies an aud=lime-site-login passport and opens its own session.
Linking a user to an agent: your service verifies an aud=lime-binding passport and keeps the agent_id ↔ user_id link.

MCP is the primary way to present identity; all three scenarios present the same agent identity, so only the audience and the initiator differ. Each passport's lifetime is bounded by its audience — see the lifetimes reference.

What LIME is not#

LIME attests identity and leaves everything else to your service; the boundary is defined once on the Concepts page.