# Wicked Identity

> Reverse-CAPTCHA / Know-Your-Agent verification for autonomous agents on Base: proves an HTTP caller is (or is not) an agent, and binds that proof to a specific, accountable wallet.

## What verification means

Wicked Identity issues a real, time-boxed challenge (a constrained-generation task -- an exact word count plus a letter-sum constraint, solved simultaneously, default 30-second budget) grounded in the aCAPTCHA paper (arXiv 2603.07116) and Moltbook's reverse-CAPTCHA approach. A response is scored pass / fail / inconclusive -- never forced to a binary result when the outcome is genuinely ambiguous (a near-miss, or a correct answer that arrived just past the deadline). On pass, the wallet receives a short-lived signed assertion (a standard RS256 JWT, default 15-minute TTL) that any third party can verify locally against GET /.well-known/jwks.json, with no callback to this service required.

This is a friction/signal layer, not an unbeatable human-vs-agent detector -- a motivated human, or a human relaying the challenge to their own LLM, can still pass it. Treat a pass as "completed a time-boxed automation-favoring challenge," not as a guarantee of non-humanity.

## Auth model

Registration and challenge/response are wallet-signature authenticated: GET /agents/{wallet}/nonce issues a one-time nonce, sign it (EIP-191 personal_sign) with the wallet being registered/verified, then submit the signature -- the same mechanism Wicked Reputation's staking flow uses. GET /verify/status/{wallet} is public and read-only: free with a valid x-api-key (rate-limited), or a real x402 402 challenge for keyless callers (USDC on Base mainnet, $0.001/call).

## Quickstart for agents

Full guide with a complete runnable example: https://verify.wickedapi.com/llms-full.txt

No wallet or can't sign? Use a SANDBOX identity -- no signing at all:
  POST /sandbox/register -> {wallet, sandbox_token}; then POST /verify/challenge and POST /verify/response with
  {wallet_address, sandbox_token} (no nonce/signature). Sandbox results are for testing: separate signing key
  (/.well-known/jwks-sandbox.json) and /verify/status never reports them as verified.
Want to call GET /verify/status for free? POST /keys/test returns a 7-day test API key (send as x-api-key).

Real wallet (accountable identity), the path relying parties should trust:

1. GET /agents/{wallet}/nonce, sign the returned `message` (EIP-191 personal_sign), POST /agents/register (one-time).
2. To verify: fetch and sign TWO nonces up front -- one for POST /verify/challenge, one for POST /verify/response.
3. POST /verify/challenge starts a 30-second clock. Solve in a single pass, then immediately POST /verify/response with the pre-signed nonce.

Timing rule: nonces are single-use (valid 300s), so pre-fetch the one you need for the response BEFORE requesting the challenge. Fetching it while the clock runs is the most common way to fail.

Errors are always JSON {"error": "...", "source": "..."} with a plain-English message; 422s add a "details" list of {field, problem}.

## Relationship to Wicked Reputation

Wicked Identity keeps its own lightweight identity record (wallet-signature registration only, no staking) so it works standalone for wallets that have never staked. It does not duplicate Wicked Reputation's stake/tier data -- at verification time it calls Wicked Reputation's live GET /agents/{wallet}/status over HTTP and, if the wallet holds an active stake there, factors that in as a positive confidence signal. A Wicked Reputation outage never blocks a Wicked Identity verification.

## Endpoints

- Landing page: https://verify.wickedapi.com/
- API docs (OpenAPI/Swagger UI): https://verify.wickedapi.com/docs
- OpenAPI spec: https://verify.wickedapi.com/openapi.json
- Nonce: GET /agents/{wallet}/nonce
- Register: POST /agents/register
- Issue challenge: POST /verify/challenge
- Submit response: POST /verify/response
- Verify status (public): GET /verify/status/{wallet}
- JWKS (independent token verification): GET /.well-known/jwks.json
- Service catalog: GET /v1/status
- Full agent guide: https://verify.wickedapi.com/llms-full.txt
- Health: GET /health