Integrate as an Agent Developer

The upstream Integration: Agent guide is the practical reference: discovery, signature verification (JCS + Ed25519), signal evaluation, and edge cases (caching, rate limits, 404 handling) with TypeScript examples.

Authority allowlist

Agents enforce an authority domain allowlist — they only trust verify endpoints whose hostname appears on the list. To consume signals from the authorities catalogued in Implementations, include the corresponding domains. Today that means:

trstd-protocol.trustedshops.com

Any verify-endpoint URL discovered from a service provider's <link rel="trstd-protocol"> tag whose hostname is not on the allowlist must be rejected before issuing a request.