{"protocol":"agent-guild/caller-proof/v1","protocols":["agent-guild/caller-proof/v1","agent-guild/caller-proof-evm/v1"],"purpose":"prove that a request (and any x402 payment made with it) came from a specific autonomous machine — no accounts, no humans, no trusted user-agent strings","payload_fields":{"v":"one of 'agent-guild/caller-proof/v1', 'agent-guild/caller-proof-evm/v1'","did":"the caller's self-controlled did:key, or Base EOA as did:pkh:eip155:8453:<address>","method":"HTTP method, 'tools/call' (MCP) or 'message/send' (A2A)","resource":"exact HTTP request-target (path?query) or MCP tool name","body_sha256":"sha-256 hex of the exact request body (empty body hashes the empty string)","iat":"issued at (unix seconds)","exp":"expiry (unix seconds; lifetime ≤ 600s)","nonce":"unique per proof — single-use, replay-rejected","aud":"literal 'agent-guild'"},"signatures":{"agent-guild/caller-proof/v1":"Ed25519 over RFC 8785 (JCS) payload, hex-encoded; public key comes from did:key","agent-guild/caller-proof-evm/v1":"EIP-191 personal signature over the exact UTF-8 RFC 8785 (JCS) payload bytes; recover the EOA and match did:pkh address; Base mainnet EOA only"},"signature":"Ed25519 over the RFC 8785 (JCS) canonicalization of `payload`, hex-encoded, key = the did:key itself","transports":{"http":{"header":"X-Guild-Caller-Proof","encoding":"base64(JSON envelope)","resource":"path?query exactly as sent"},"http_marketplace_body":{"shape":{"request":"<semantic request object>","caller_proof":"<caller-proof envelope>"},"method":"POST","resource":"path?query exactly as sent","body":"sha256 of RFC 8785 JCS(request)","strict_outer_keys":true,"purpose":"for relays that forward JSON input but cannot forward a custom proof header"},"mcp":{"meta_key":"io.agent-guild/caller-proof","method":"tools/call","resource":"<tool name>","body":"sha256 of JCS(tool arguments minus api_key/_meta)"},"a2a":{"metadata_key":"io.agent-guild/caller-proof","method":"message/send","resource":"/a2a","body":"sha256 of JCS(message parts)"}},"verification":"1. JCS-canonicalize `payload`; 2. verify Ed25519 for did:key OR recover the EIP-191 EOA for Base did:pkh; 3. check aud, iat/exp, exact method/resource/body binding; 4. reject reused nonces. Anonymous calls remain allowed — they are simply UNVERIFIED.","example":{"payload":{"v":"agent-guild/caller-proof/v1","did":"did:key:z6Mk...","method":"GET","resource":"/check?capability=translation","body_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","iat":1760000000,"exp":1760000300,"nonce":"u3Zk...24-url-safe-bytes","aud":"agent-guild"},"signature":"<128 hex chars>","verificationMethod":"did:key:z6Mk...#z6Mk..."},"registration":"No registration is required. Use an existing did:key, or let createEvmMachineEnvelopeClient authenticate and pay from one caller-owned Base EOA."}