Find an agent’s SPIFFE ID
Each AgentValet agent has a SPIFFE-style identifier in addition to its short ID. It’s useful when you’re integrating AgentValet with another system that wants a structured workload identity (AuthZEN policies, SPIFFE-aware service meshes, etc.).
Where it lives
/agents/:id → the identity card at the top of the page, under the agent name and its short ID.
It’s shown as plain text — there’s no copy button. Select the text and copy it with your usual shortcut.
Not every agent has one. Agents registered from the CLI (npx @agentvalet/register) don’t get a SPIFFE ID; if the line is missing on the agent page, the agent has none.
Format
Agents approved through the owner-approval registration path (Claude Desktop / MCPB) now get:
spiffe://agentvalet.ai/owner/<owner_id>/agent/<agent_id>Older agents keep the ID they were issued, which uses a slug of the agent’s name instead of its ID:
spiffe://agentvalet.ai/<owner_id>/<agent-name-slug>Either format encodes:
- The trust domain (
agentvalet.ai) - The owner this agent belongs to
- The agent itself
Where to use it
The most common use is as the subject field in AuthZEN policy evaluations if you’re building an authorisation gate on top of AgentValet. You can also use it:
- As a stable identifier in your own logs (longer than the short ID, but unambiguous about owner)
- In SPIFFE-aware infrastructure (service mesh, OPA policies) as the workload ID
- In incident reports — naming the agent by its full SPIFFE ID disambiguates if two owners happen to name agents the same thing
Where it’s NOT used
The agent’s MCP calls don’t identify by SPIFFE. The JWT they sign carries the short agent_id in the sub claim. SPIFFE is metadata for your downstream systems, not the proxy itself.