Vestauth – Auth for Agents

Name: Vestauth – Auth for Agents
Availability: InStock
Author: scottmotte

by scottmotte·Feb 17, 2026·11 points·1 comment

Visit Project View on HN

AI Analysis

●●●BangerBig BrainSolve My ProblemZero to One

Agent auth via key-signing beats API keys and OAuth for autonomous systems.

Strengths

•Novel architectural insight: agents can't use OAuth; cryptographic identity is the right primitive.
•RFC 9421 compatible; not a one-off hack—aligned with emerging standards for bot auth.
•Creator of dotenv brings credibility; solves real problem in dotenvx ecosystem.

Weaknesses

•Early stage (just launched); adoption risk is high, and ecosystem needs critical mass.
•Narrow audience for now: only matters if building multi-agent systems requiring agent signup.

Post Description

I"m the creator of dotenv and dotenvx. A month ago I started building a way for agents to store and rotate secrets as part of dotenvx and I ran into a problem. Agents can't sign themselves up autonomously. They need a way to do this - without a human in the loop.

I searched for solutions but wasn't happy with any so I created Vestauth.

Here's how it works:

It manages both the agent and the provider side. The agent with one command can set up a cryptographic identity avoiding human designed handshake mechanisms like OAuth. And on the provider side there is no management of API keys, no username and passwords, no users table even. Authentication works with a single line of code verifying this cryptographically.