Modei
PricingDocsBlog

Documentation

Theme
Log inSign up

Issuers

An Issuer is your signing identity, the organizational stamp that proves you authorized an agent's passport. Every passport traces back to an issuer.

··

What is an Issuer?

An Issuer represents an organization, person, or system that has the authority to issue passports to agents. When an agent presents its passport at a gate, the gate doesn't just verify the agent, it also verifies the issuer that signed the passport.

This creates a chain of trust: the gate trusts issuers at or above a certain tier, the issuer signs passports, and agents carry those passports as proof of authorized identity.

Issuers have a domain (e.g., acmecorp.com), a trust tier (L1-L3), and a public key that gates use to verify passport signatures.

Trust Tiers

Baseline (L1)

Self-issued. No account required. Generated locally via the Modei SDK. Ideal for development, testing, and personal use. No external verification.

Use when: Local development, air-gapped environments, personal automation, early prototyping.

Trusted (L2)

Managed platform issuer. Created through the Modei dashboard or API. Verified domain ownership. Used for production deployments within an organization.

Use when: Production agents, team deployments, any agent that interacts with real APIs or data.

Verified (L3)Coming Soon

The highest assurance profile. Requires Proof of Possession (PoP), mandatory revocation checks, delegation chain verification, and canonical JSON. No implicit trust. Coming Soon.

Use when: Multi-tenant environments, financial transactions, healthcare, compliance workloads, regulated industries.

Creating an Issuer (Dashboard)

1

From your dashboard, click Issuers in the sidebar

2

Click Create Issuer

3

Enter a name (e.g., "Acme Corp" or "Jason's AI Lab")

4

Enter your domain (e.g., acmecorp.com)

5

Choose a trust tier (L1 or L2 for now)

6

Click Create

Your issuer is created and its public key is registered on the Modei platform. Any gate configured to accept this issuer's tier will now trust passports signed by it.

Creating a Local Issuer (SDK)

For L1 self-issued passports, no account is required. Create a local issuer entirely in code:

python
# pip install modei-python --pre
from datetime import timedelta
from modei import AgentCredentials, PassportIssuer

# Generate a local agent keypair, no account needed.
credentials = AgentCredentials.generate()

# Construct an issuer bound to these local credentials.
issuer = PassportIssuer(
    credentials,
    identity_claim="email-assistant@dev.local",
)

# Self-issue a passport, signed locally, no network required.
signed = issuer.self_issue(
    permissions=[
        {"permission_key": "email:read", "constraints": {}},
        {"permission_key": "email:send", "constraints": {}},
    ],
    expires_in=timedelta(days=30),
)

print("passport_id:", signed.envelope.passport_id)

This example uses the Modei SDK (pip install modei-python --pre) for local cryptographic operations. For managed operations, use the Modei REST API.

typescript
// npm install modei-typescript@next
import { AgentCredentials, PassportIssuer } from 'modei-typescript';

// Generate a local agent keypair.
const credentials = AgentCredentials.generate();

// Self-issue a passport, signed locally, no network required.
const passport = new PassportIssuer(credentials, {
  identityClaim: 'email-assistant@dev.local',
}).selfIssue({
  permissions: [
    { permission_key: 'email:read', constraints: {} },
    { permission_key: 'email:send', constraints: {} },
  ],
  expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
});

console.log('passport_id:', passport.envelope.passport_id);

This example uses the Modei SDK (npm install modei-typescript@next) for local cryptographic operations. For managed operations, use the Modei REST API.

Creating a Managed Issuer (API)

bash
curl -X POST https://modei.ai/api/v1/issuers \
  -H "Authorization: Bearer mod_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corp",
    "domain": "acmecorp.com",
    "trust_tier": "L2",
    "metadata": {
      "team": "platform-engineering"
    }
  }'
Response
{
  "issuer_id": "iss_01HXYZ...",
  "name": "Acme Corp",
  "domain": "acmecorp.com",
  "trust_tier": "L2",
  "public_key": "ed25519:...",
  "created_at": "2026-02-24T10:00:00Z",
  "passport_count": 0
}

Related

How It WorksPassports