agent-identity

Agent identity

Read the signing identity, model payer, and env metadata from their own sources. Never print tokens, private keys, or recovery phrases in diagnostics.

1. Verify the live agent

Query the configured Host /info endpoint and read address. Use the actual service port, not an assumed hostname or a copied AGENT_ADDRESS value.

curl --fail --silent --show-error http://localhost:8000/info \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["address"])'

The key determines the address. AGENT_EMAIL and IS_EMAIL_ACTIVE are email metadata. Env address notes, server inventories, and DNS names can be stale.

2. Check the selected account

All env settings default to $AGENT_CONFIG_PATH/keys.env, normally ~/.co/keys.env. Entering a project never loads its .env. co --env-file /path/to/app.env … explicitly selects a different file; inherited process settings win. With explicit selection, CLI identity readers use an existing key in the file's adjacent .co/, falling back to the global key when it has none. co init initializes global configuration; project creation requires co create or an explicit co init ./.

Run this diagnostic in the target process's environment. Decoding alone does not verify a JWT. The GET checks the same backend used by auth and models, refuses redirects, and prints only the account and balance.

import base64
import json
import os
from pathlib import Path
import requests
from connectonion.backend import backend_url
from connectonion.environment import load_environment, select_env_file

# Optional explicit selection, equivalent to co --env-file /path/to/app.env:
# select_env_file(Path("/path/to/app.env"))
load_environment()
token = os.environ.get("OPENONION_API_KEY")
if not token:
    raise SystemExit("No managed-model token in the selected environment")
try:
    payload = token.split(".")[1]
    claims = json.loads(base64.urlsafe_b64decode(payload + "=" * (-len(payload) % 4)))
    print("Token account (unverified claim):", claims["public_key"])
except (IndexError, KeyError, ValueError, UnicodeError):
    raise SystemExit("Token is not a decodable account JWT; do not print it") from None

# Resolve the same backend as auth/models. Never put a token in shell arguments.
response = requests.get(
    f"{backend_url()}/api/v1/auth/me",
    headers={"Authorization": f"Bearer {token}"},
    timeout=15,
    allow_redirects=False,
)
if response.status_code != 200:
    raise SystemExit(f"Account lookup failed (HTTP {response.status_code})")
account = response.json()
print("Verified account:", account.get("public_key"))
print("Balance:", account.get("balance_usd"))