For configured MPP requests, Grantex passports carry signed principal, organization, and policy claims. Merchants must still validate the payment, enforce limits, and refresh key and revocation status material.
When an agent makes an MPP payment, the source is just a wallet address. No human name, no org, no authorization chain. As transaction value and procurement risk increase, missing principal and policy context can become a security or compliance concern.
A configured MPP request can carry an AgentPassportCredential with principal, organization, category, and limit claims. Merchants validate the credential with obtained keys and separately enforce the payment request.
npm install @grantex/mpp — agent-side middleware + merchant-side verification in one package.
Call grantex.passports.issue() with categories (inference, compute, data), spending limits, and expiry.
createMppPassportMiddleware() adds the X-Grantex-Passport header to requests that pass through the configured middleware.
requireAgentPassport() can validate passport signatures and claims at an Express boundary; the merchant still enforces the requested category and amount.
lookupOrgTrust() returns the public organization record and current DNS-backed trust level.
import { Grantex } from '@grantex/sdk';
import { createMppPassportMiddleware, requireAgentPassport } from '@grantex/mpp';
// Agent side: issue passport and attach to requests
const grantex = new Grantex({ apiKey: process.env.GRANTEX_API_KEY });
const passport = await grantex.passports.issue({
agentId: 'ag_01HXYZ...',
grantId: 'grnt_01HXYZ...',
allowedMPPCategories: ['inference', 'compute'],
maxTransactionAmount: { amount: 50, currency: 'USDC' },
expiresIn: '24h',
});
const middleware = createMppPassportMiddleware({ passport });
const enriched = await middleware(new Request(url));
// X-Grantex-Passport header attached
// Merchant side: validate the passport, then enforce payment policy
app.use('/api/inference', requireAgentPassport({
requiredCategories: ['inference'],
maxAmount: 10,
}));
// req.agentPassport → { humanDID, orgDID, categories, maxAmount, ... }W3C VC 2.0 with agent DID, human principal, org, categories, spending limits, and delegation depth.
Signature verification can reuse cached JWKS after keys are obtained; initial retrieval and key-rotation refreshes require network access.
inference, compute, data, storage, search, media, delivery, browser, general — each maps to a Grantex scope.
Publish passport revocation state through a status list that verifiers can refresh and cache.
Public organization lookup by DID with DNS TXT domain verification.
Middleware proactively refreshes passports before expiry via onRefresh callback.
AgentPassportCredential verification establishes signed identity and policy claims after key and status material are obtained. The merchant still must enforce category and amount limits at the protected action, refresh revocation status according to policy, and keep payment or order execution in its own trusted system.
Follow the integration guide and verify the package version before deployment. Apache 2.0.