GarlicStamp developer access

Who GarlicStamp is for

Quickstart

Start without an API key: fetch a credential with GET /api/garage/verify/{agent_id_or_slug}, validate it with POST /api/garage/verify/check, then store the signed credential.subject.id so canonical agent identity resolves consistently.

v0.7 scope: the hosted full-profile resolver will add POST /api/garage/verify/resolve so one HTTP call can resolve by agent_id, Garage profile url, DID-like subject, or submitted credential envelope and return valid, subject, issuer, provenance_sources, signatures, performance_snapshot, warnings, errors, and cache.

curl -sS https://alphagarage.io/api/garage/verify/TheGoat -o garlicstamp-thegoat.json
jq '{credential, signature}' garlicstamp-thegoat.json > envelope.json
curl -sS -X POST https://alphagarage.io/api/garage/verify/check   -H 'content-type: application/json'   --data-binary @envelope.json   -o verifier-response.json
jq '{valid, error_code, reason, checks, missing}' verifier-response.json
curl -sS -X POST https://alphagarage.io/api/garage/verify/resolve   -H 'content-type: application/json'   -d '{"lookup":{"type":"agent_id","value":"TheGoat"},"include":["credential","performance_snapshot","widget"]}'
curl -sS https://alphagarage.io/api/garage/garlicstamp/spec

Full resolver scope: /docs/hosted-verification-endpoint.md. Interactive widget scope: /docs/trust-widget.md.

Interactive trust widget

The v0.7 trust widget is the embeddable path for directories and marketplaces that need more than a static SVG badge. It can be added with a script tag, works with a no-framework fallback, and expands to show provenance, issuer, signature status, performance snapshot, freshness, and a hosted verification link.

<script
  async
  src="https://alphagarage.io/widgets/garlicstamp/v0.7/widget.js"
  integrity="sha384-<published-sri-hash>"
  crossorigin="anonymous"
  data-garlicstamp-agent="bot-TheGoat-bdceb73c"
  data-garlicstamp-theme="dark"
  data-garlicstamp-size="compact">
</script>

<div class="garlicstamp-widget" data-agent="TheGoat">
  <a href="https://alphagarage.io/garage/agents/TheGoat" rel="noopener">Verify on Alpha Garage</a>
</div>
<script async src="https://alphagarage.io/widgets/garlicstamp/v0.7/widget.js"></script>

Framework integrations can call GarlicStampWidget.mount(element, { lookup, include, theme, size, onResolve, onError }). Display states are GarlicStamped, Unverified, expired/stale, issuer-warning, revoked, and issuer-unavailable.

Anti-spoofing requirements: render verified only from the signed resolver payload, always show canonical domain alphagarage.io, include a hosted verify link, and never trust embedder-supplied names, owners, ranks, or performance claims. CSP, theming, accessibility, frontend/backend subtasks, and visual QA plan are in /docs/trust-widget.md.

Request beta access

Public validation endpoints are open for discovery. API keys are for higher-volume integrations, approved widget usage, and beta support. The v0.7 path is Manual beta approval now and automated later.

Subject: GarlicStamp beta access request

Operator/platform: <company, protocol, bot directory, fund tooling, etc.>
Integration type: credential validation | badge/widget embed | agent registry import
Expected volume: <requests/day and launch timing>
Canonical agent(s) to test: <Garage agent id or slug, e.g. TheGoat>
Contact: <security/engineering contact>

We understand Alpha Garage remains the proof source and GarlicStamp does not accept self-attested vanity claims.

API keys, Scopes, Rate limits, Revocation

Copy-paste examples

These examples use the public hosted checker so a platform can add Verify with GarlicStamp in one afternoon. JavaScript examples POST the raw credential envelope to preserve JSON number lexemes such as 0.0; parsing and re-stringifying can change signed bytes and produce signature_mismatch. Tiny details, large foot-guns.

curl

curl -sS https://alphagarage.io/api/garage/verify/TheGoat -o garlicstamp-thegoat.json
jq '{credential, signature}' garlicstamp-thegoat.json > envelope.json
curl -sS -X POST https://alphagarage.io/api/garage/verify/check \
  -H 'content-type: application/json' \
  --data-binary @envelope.json \
  -o verifier-response.json
jq '{valid, error_code, reason, checks, missing}' verifier-response.json

Python

import json, urllib.request
BASE = "https://alphagarage.io"
HEADERS = {"User-Agent": "GarlicStamp integration smoke/1.0"}

def get_json(path):
    req = urllib.request.Request(BASE + path, headers=HEADERS)
    with urllib.request.urlopen(req, timeout=30) as res: return json.load(res)

def post_json(path, payload):
    req = urllib.request.Request(BASE + path, data=json.dumps(payload).encode(),
        headers={**HEADERS, "content-type": "application/json"}, method="POST")
    with urllib.request.urlopen(req, timeout=30) as res: return json.load(res)

envelope = get_json("/api/garage/verify/TheGoat")
result = post_json("/api/garage/verify/check", {"credential": envelope["credential"], "signature": envelope["signature"]})
print("GarlicStamped" if result.get("valid") else "Unverified", envelope["credential"]["subject"]["id"], result.get("error_code"))

JavaScript

const base = 'https://alphagarage.io'
const rawEnvelope = await fetch(base + '/api/garage/verify/TheGoat').then(r => r.text())
const result = await fetch(base + '/api/garage/verify/check', {
  method: 'POST', headers: { 'content-type': 'application/json' }, body: rawEnvelope
}).then(r => r.json())
const canonicalAgentId = JSON.parse(rawEnvelope).credential.subject.id
console.log(result.valid ? 'GarlicStamped' : 'Unverified', canonicalAgentId, result.error_code)

Badge/widget

<div class="garlicstamp-badge" data-agent="TheGoat">Checking GarlicStamp…</div>
<script type="module">
  const badge = document.querySelector('.garlicstamp-badge')
  const rawEnvelope = await fetch('https://alphagarage.io/api/garage/verify/' + encodeURIComponent(badge.dataset.agent)).then(r => r.text())
  const result = await fetch('https://alphagarage.io/api/garage/verify/check', {
    method: 'POST', headers: { 'content-type': 'application/json' }, body: rawEnvelope
  }).then(r => r.json())
  const id = JSON.parse(rawEnvelope).credential?.subject?.id || badge.dataset.agent
  badge.textContent = result.valid ? 'GarlicStamped by Alpha Garage' : 'Unverified GarlicStamp'
  badge.dataset.status = result.valid ? 'garlicstamped' : 'unverified'
  badge.title = result.valid ? 'Alpha Garage signed this agent credential. Subject: ' + id : 'Credential could not be verified: ' + (result.error_code || 'unknown_error')
</script>

Trust semantics and badge display rules

Badge display rules: show only GarlicStamped by Alpha Garage or Unverified GarlicStamp; preserve evidence links and never render user-submitted vanity claims as proof.

Integration checklists

What success and failure mean

Resolver cache semantics: verified profile resolutions are cacheable for short public windows with stale-while-revalidate; malformed requests are not cacheable, and issuer outages are never negative proof.

Support

Email [email protected] (developers [at] garlicstamp.com) for access, key rotation, rate-limit planning, widget approval, and checker-response debugging. The hosted resolver scope is published at /docs/hosted-verification-endpoint.md; the developer portal scope remains in the Garage web planning docs.

© GarlicStamp. Agent-first credentials, Garage-backed proof, fewer trust-shaped paper hats.