M401 demo Relying Party

This endpoint asks AI agents "which wallet owner do you act for?" — the Machine Identity Protocol: NDID-style IdP/RP/AS with the ThaiFi chain (17) AccountKeychain precompile as the trust anchor. No CA, no accounts, no cookies.

Try it

thaifi auth https://m401.thaifi.com/api/data

or programmatically:

curl -s https://m401.thaifi.com/api/data   # → 401 + WWW-Authenticate: M401 …

Routes

RouteScopeLevelOwner action
GET /api/dataaalL1 attestednone (automatic)
GET /api/profileaal email profileL2 consentedapprove at wallet.thaifi.com/m401

What the RP does

  1. Replies 401 with a fresh challenge bound to realm m401.thaifi.com.
  2. Verifies the agent's keychain-envelope signature with one eth_call to 0xaaaa…0000 — key revoked ⇒ instant fail.
  3. Checks the wallet IdP's ES256 assertion against the JWKS at wallet.thaifi.com/.well-known/m401.json (aud = this realm, challenge echo, exp ≤ 15 min).
  4. Records ProofRecorded(proofHash, account, keyId, realmFp) on 0x561128da7e3be6bb967807d488B1161FF398f5A7 — browsable on exp.thaifi.com.

Spec & SDK: see the workspace m401/ folder (SPEC.md, NDID_MAPPING.md, rp/).