Egoist AI Passport

The partner program is in private beta. This page records changes that affect partner integrations.

2026-09-03

Grant revocation without a refresh token

Authorization-code exchanges can return a one-time revocation_handle. Native clients can persist it with a stable command identifier and revoke the grant after destroying local bearer tokens.

Purpose scopes for metadata-document clients

A Client Identifier Metadata Document may declare booking:actions and connector:reads in scope. A client can request a purpose scope only when its document declares it and the deployment offers it.
clientMetadataDocument() in ai-passport-signin accepts a scope array.

Signed directed-disclosure deliveries

Every delivery carries a short-lived signed Passport-Disclosure-Attestation header next to the stable Idempotency-Key. Verify it against the JWKS before reading the body.
Delivery is now at most once. Passport retries only when the destination provably did not process the request. An unanswered request or a 5xx response is never sent again and the status stays pending.
request_disclosure accepts a controlled purpose: directed_disclosure (default) or travel_booking.

Access-token client binding

ID tokens include at_hash. Verify it against the access token returned in the same exchange.
Added POST /oauth/token-info, advertised as introspection_endpoint. It takes the access token as its bearer and returns the server-derived client_id, sub, scope, and exp.
Token-info also accepts a sender-constrained access token with the DPoP scheme and a DPoP proof. It returns token_type DPoP, the confirmation thumbprint, and the registered device id.
complete() in ai-passport-signin now verifies at_hash and requires the issuer to emit it.

2026-08-20

Added Client Identifier Metadata Documents (CIMD) as a rolling registration and admission path for host-consistent clients.
Added the ai-passport-signin package with browser, React, and server helpers.
Added official light and dark sign-in button assets and the approved mark.
Added agent-facing documentation and the /llms-install.md install prompt.

Compatibility contract

The /v1 contract can grow without a version change. Treat these changes as additive and non-breaking:

New endpoints
New optional response fields
New error strings
New item status values

Clients shall tolerate all four changes. Ignore fields you do not use. Keep an unknown error or status visible in diagnostics.

Removing a field, requiring a new input, or changing existing behavior is a breaking change. We give private-beta partners direct notice before one ships.

Quota changes are operational changes. Read current dials from GET /partner/v1/me and honor Retry-After.