Authentication

Human Wallet HS256 tokens and Partner access tokens are not accepted on the agent money path.

Assertion → access token

POST https://imbawallet.com/auth/v1/agent/token
Content-Type: application/json

{ "assertion": "<JWT>" }

Claim	Required	Notes
`iss`	yes	Decimal text `client_id` from register
`aud`	yes	Always `imba-agent-api`
`iat` / `exp`	yes	Max 60s lifetime
`kid` (header)	yes	Key id from register
`alg` (header)	yes	`EdDSA`

Field	Value
TTL	~900 seconds
`typ`	`agent`
`client_id`	This agent only
Signature	EdDSA — JWKS `GET https://imbawallet.com/auth/v1/partner/jwks` (same keys as Partner)

Never send client_id in the body to pick another wallet. The JWT is the identity.

Situation	Effect
Caution medium	New register only
under_attack or Agent API disabled	Whole agent channel, including `/auth/v1/agent/token` and `/x402/*`

Limit	Default
Assertions / kid / minute	30
Assertions / IP / minute	60

429 when exceeded. Back off with jitter. Mint a new assertion when the access token is near expiry — there is no refresh token.