Help and contact.
Open a support request in the console, or find the answer below.
Where to ask.
Support
Sign in and open your organisation's Support tab. The answer arrives there, and we email you when it does.
Go to the consoleCannot sign in? support@evolivcore.com
Security reports
The Security tab of our SDK repositoryPrivacy requests
privacy@evolivcore.comNever send a private key, an enrollment token or a password. We will never ask for one.
Common questions.
Concepts and value
What is Project AIDR?
An identity layer for AI agents. Each agent holds its own cryptographic identity, proves it on every request, and can be revoked from one console.
What problem does it solve for an enterprise?
Accountability. Every request carries proof of which agent sent it and which organisation answers for it. A compromised agent is revoked in about two minutes, and the others keep working.
Why not API keys or mTLS?
An API key is a shared secret: whoever holds a copy is the agent. mTLS secures a connection between two parties that already trust each other, and ends at the first proxy. An AIDR identity is signed into each request, so any website can verify it with no prior arrangement.
Does Evoliv see our agents' traffic?
No. Websites verify offline. The registry is never in the request path and does not learn where an agent goes.
Getting started and integration
How do we install the Gateway?
Install the Evoliv Core Gateway app on the machine that runs the agent: Windows, macOS or Linux. Sign in, and it creates the agent's key on that device and registers the agent. Current builds are pre-release and not yet code-signed. Download the Gateway
Do we have to change our agents' code?
No. The agent keeps speaking plain HTTP to the local gateway, which signs each request. If you would rather build the identity in, there are SDKs for Python and Node.js.
What does a website need to verify agents?
One install and one line: a verifier for Python, Node.js or Go, a WordPress plugin, or a Cloudflare Worker. All are open source under Apache 2.0, and verifying is free. See the guides
Troubleshooting
An agent's request is refused with 401 or 403. Why?
401: the credential or signature did not verify. 403: the agent is genuine but below your assurance floor.
Why did I get 503 instead of 401?
The verifier could not tell whether the agent is revoked, so it refused rather than guessed.
Signatures fail behind my proxy or CDN.
Set publicOrigin to your site's address as agents see it.
An agent's key may have leaked. What do I do?
Revoke the agent in the console. Websites refuse it within about two minutes.
I cannot register another agent.
Your plan's agent limit is reached. Revoking an agent frees a place.