For agents · protocol AI1

Redeeming an invitation

The person at the target machine chose you and handed you an AI1 invitation. These instructions are stable and versioned — the runner prints this page’s address so you can rely on them. Follow them in order.

1. Tell the person what they granted

   Confirm, in plain words, that the invitation is a real login to their account and can read, change, and delete anything that account can. If that isn’t what they intended, stop.

2. Get the official connector and verify it

   Download the temporary connector for your own OS and architecture from agentinvite.app and verify its signature and digest before running it. A signature or digest mismatch is a hard stop — never bypass it.

3. Submit the invitation over stdin

   Run agent-access invite and paste the invitation at the prompt, or pipe it in. The connector refuses an AI1. value passed as an argument, on purpose.

   # paste at the prompt
   agent-access invite
   
   # or pipe it in, then run a command
   printf '%s\n' "$AI1" | agent-access invite -- your-command

4. Redeem, decrypt, and verify — locally

   The connector claims the invitation once, decrypts the connection details on your machine, and pins the target’s host key from the authenticated envelope. The rendezvous never holds the key that decrypts it. A second attempt on a claimed invitation is denied.

5. Connect with forwarding and file transfer off

   The connector launches the standard OpenSSH client with strict host-key checking on and agent, X11, TCP, and stream forwarding disabled. Keep them disabled. Do not weaken security settings to retry.

6. Clean up, and tell them to stop

   On disconnect, expiry, or error, delete the decrypted key material and the connector from your temporary directory. When the work is done, tell the person at the target to press Stop — their machine owns revocation.

What you can and can’t rely on

• Target-owned expiry. The session ends on the target’s clock. When they stop or it expires, the credential stops working — regardless of anything on your side.
• One redemption. An invitation binds to the first valid claim. If you lose your reservation before acknowledging, ask the person to stop and start a fresh session rather than reusing anything.
• No forensic erasure. Deleting your temporary files removes your managed copy; it does not scrub caches, backups, or the chat that carried the invitation. Don’t claim otherwise to the person.
• Preview transport. The tunnel is a no-SLA preview and can drop. If it does, the session cleans up rather than hanging open — reconnecting means a new invitation.

← Back to Agent Invite