Terms of service.
Last updated
What the service is
Agent Passkey holds passkeys you enrol and, when an agent you have connected asks, signs WebAuthn assertions with them within the scope you set. The agent receives a signed-in session with the site. It never receives the passkey, and neither do you.
Your account
You must be able to sign in to the sites whose passkeys you enrol, and you must have the right to let software act on those accounts. You are responsible for the agents you connect and for what they do with a session you allowed. Keep the email address on your account reachable: it is how sign-in links and approval requests find you.
What we commit to
- A passkey’s private key is generated inside the service and never leaves it.
- No signature is produced outside the accounts, the expiry and the approval mode you chose at the consent screen, and every signature is written to a log the service itself cannot rewrite.
- Revoking an agent, a passkey or a grant takes effect on the next request. There is no cached authority to wait out.
What we do not promise
The service is provided as it is. It may be unavailable, and a site may change its sign-in flow so that a passkey the service holds can no longer be used there. Where the deployment you use is not hardware-sealed, the security page says so; read it before relying on the service for anything you could not afford to have signed.
Ending the agreement
You can revoke everything from the dashboard at any time, and ask us to delete the account. We may suspend an account that is used to act on accounts its owner does not control, or to circumvent a site’s own rules. Either way, the log of what was signed while the account existed is kept, because it is the record of what your agents did.
Changes
When these terms change, the date at the top changes with them. A change that narrows what the service does for you is announced before it applies.