Simple integration. One API call.

Sign up at agentvisa.ai/signup/vendor, verify your email, and log into your dashboard. Create a widget for your domain and copy your widget ID and API key.

Drop this into your page's HTML. It injects a discovery signal for AI agents and renders a visible “AgentVisa Protected” badge.

<script src="https://cdn.agentvisa.ai/widget.js"
        data-widget-id="YOUR_WIDGET_ID"></script>

The widget ID is semi-public — it can live in your frontend. Your API key stays server-side only.

Two calls are involved. First the agent exchanges its permanent token for a short-lived temporary token scoped to your site. Then your server validates that temporary token. The permanent token never reaches your server.

// Step 1 — your site has no token yet, signal the agent:
HTTP 401
X-AgentVisa-Required: YOUR_WIDGET_ID

// Step 2 — agent calls AgentVisa to get a temporary token (60 min, your site only):
curl -X POST "https://api.agentvisa.ai/v1/token/assert" \
     -H "Content-Type: application/json" \
     -d '{"token":"AGENT_API_TOKEN","widget_id":"YOUR_WIDGET_ID","duration_minutes":60}'
// → { "temp_token": "tmp_...", "expires_at": "..." }

// Step 3 — agent retries your site with the temporary token:
X-AgentVisa-Token: tmp_...

// Step 4 — your server validates (never client-side):
curl -X POST "https://api.agentvisa.ai/v1/verify" \
     -H "Content-Type: application/json" \
     -H "X-Widget-Api-Key: YOUR_API_KEY" \
     -d '{"token":"tmp_...","widget_id":"YOUR_WIDGET_ID"}'

// Response (Basic plan)
{ "valid": true, "reason": "ok", "plan": "basic",
  "widget_id": "wgt_abc123", "verified_at": "2026-05-29T14:32:11Z",
  "expires_at": "2026-05-29T15:32:11Z", "domain_verified": true }

// Response (invalid)
{ "valid": false, "reason": "reverification_required" }

// Response (Pro plan — confirmation flags, no personal data shared)
// Optional: include confirm_email / confirm_phone_last4 to get AVS-style confirmations
curl -X POST "https://api.agentvisa.ai/v1/verify" \
     -H "Content-Type: application/json" \
     -H "X-Widget-Api-Key: YOUR_API_KEY" \
     -d '{
       "token": "tmp_...",
       "widget_id": "YOUR_WIDGET_ID",
       "confirm_email": "user@example.com",
       "confirm_phone_last4": "7890"
     }'

{ "valid": true, "reason": "ok", "plan": "pro",
  "widget_id": "wgt_abc123", "verified_at": "2026-05-29T14:32:11Z",
  "expires_at": "2026-05-29T15:32:11Z", "domain_verified": true,
  "age_over_18": "y", "age_over_21": "y",
  "gov_id_pic_validation": null,
  "multiple_agents_authorized": "n",
  "member_since": "2026",
  "web_bot_auth_bound": true,
  "email_confirmed": true,
  "phone_last4_confirmed": false }

• GET /widget.js— The embeddable widget script. Load via script tag, no auth required.
• POST /v1/token/assert— Exchange a permanent token for a short-lived temporary token (60 min) scoped to a specific widget. Called by the agent, not the site.
• POST /v1/verify— Validate a temporary token. Body: {"token":"tmp_...","widget_id":"..."}. Called by your server with X-Widget-Api-Key. Basic returns valid/plan/timestamps; Pro additionally returns confirmation flags (age_over_18, age_over_21, member_since, web_bot_auth_bound). Pro also accepts optional confirm_email and confirm_phone_last4 fields — you supply a candidate value and receive true/false only, never the actual stored value. No personal data is ever returned.
• POST /v1/vendor/signup— Register as a Widget Holder.
• GET /v1/vendor/me— Account info and validation usage (requires auth).
• GET /v1/vendor/widgets— List your registered widgets and API keys (requires auth).
• POST /v1/vendor/widgets— Create a new widget for a domain (requires auth).
• GET /v1/holders/{holder_id}/public— Public Widget Holder lookup. AI agents call this to confirm a site's AgentVisa badge is genuine. Returns verified status, registered domains, and widget count. No auth required. Rate limited at 30 req/min per IP.

The AgentVisa MCP server is available now. Install it once in your agent and it handles token storage and presentation automatically — no copy-pasting, no system prompt needed.

// Claude Desktop — ~/Library/Application Support/Claude/claude_desktop_config.json
// Cursor — ~/.cursor/mcp.json
{
  "mcpServers": {
    "agentvisa": {
      "command": "npx",
      "args": ["-y", "@agentvisa/mcp"],
      "env": { "AGENTVISA_TOKEN": "your_token_here" }
    }
  }
}

Install: npm install -g @agentvisa/mcp or just use npx @agentvisa/mcp directly. Works with Claude Desktop, Cursor, Windsurf, and any MCP-compatible agent.

Server middleware for Express and Next.js is available now via npm install @agentvisa/widget (see @agentvisa/widget/express and @agentvisa/widget/next). FastAPI and Django middleware are planned. For any other framework, read the X-AgentVisa-Token header server-side and POST it to /v1/verify.