Machine-to-Machine Authorization: Cryptographic Ed25519 Capability Passkeys for Autonomous API Governors

In multi-agent architectures, autonomous agents frequently provision subagents, invoke external SaaS tool endpoints, and consume costly API quotas. The prevailing authorization paradigm—sharing static API secret keys (such as raw OPENAI_API_KEY or cloud provider tokens)—violates the principle of least privilege: a compromised subagent possesses full authority to exhaust company credit balances or read unrelated data stores.

This paper outlines the cryptographic architecture of Ed25519 Capability Passkeys, the authorization primitive implemented by Bartholomew Keystone to provide verifiable, non-forgeable, and mathematically bounded delegation for autonomous swarms.

1. The Ed25519 Advantage for Machine Authorization

Ed25519 is an Edwards-curve digital signature algorithm based on Curve25519. In high-frequency agent tool calling loops, Ed25519 provides three critical advantages over legacy RSA and ECDSA signatures:

• Deterministic Signatures: Ed25519 does not require a random nonce generation during signing, eliminating catastrophic private key extraction risks caused by poor random number generators in sandboxed containers.
• Microsecond Verification: On modern x86-64 and ARM64 processors, Ed25519 signature verification executes in under 45 microseconds.
• Compact Footprint: 32-byte public keys and 64-byte detached signatures minimize payload size when injected into HTTP headers (e.g. X-BTP-Passkey).

2. Passkey Structure and Payload Serialization

A Bartholomew Capability Passkey consists of a canonicalized JSON payload bound to an Ed25519 signature:

{
  "issuer": "keystone.bartholomew.info",
  "subject": "agent:swarm-094-worker",
  "capabilities": [
    "git:read:workspace",
    "compiler:build:cargo",
    "http:get:api.github.com"
  ],
  "budget": {
    "currency": "USD",
    "max_spend": 25.00,
    "allocated_spend": 3.42,
    "epoch_expiry": 1793740800
  },
  "constraints": {
    "max_file_size_mb": 10,
    "prohibited_binaries": ["rm", "dd", "mkfs", "curl"]
  },
  "nonce": "a7f9b2c8e3d1490b",
  "signature": "3b4f...d89a"
}

3. Real-Time Spend Governors and Rate Limiting

The core risk of autonomous agent operations is runaway inference spending: an agent entering an infinite recursive loop or calling reasoning models on massive documents. The Keystone governor intercepts token consumption at the tool boundary. When an agent requests a completion or external tool invocation:

1. The gateway checks the passkey's remaining budget: max_spend - allocated_spend.
2. If the estimated cost exceeds the allowance, the request is immediately rejected with HTTP 402 Payment Required or an in-IDE suspension notification.
3. The developer receives an instant approval prompt to adjust or renew the clearance budget.

4. Revocation and Ephemeral Nonces

In distributed architectures, traditional certificate revocation lists (CRLs) introduce high network overhead. Bartholomew solves this using short-lived epoch windows (typically 1 to 24 hours) combined with a local Bloom filter of active nonces. A compromised agent passkey expires automatically without requiring network-wide cache purging.

5. Implementation in Bartholomew Keystone

Keystone is packaged as an open-source VS Code / Cursor extension (published on Open-VSX) that displays clearance status directly in the status bar with minimal $(key) indicators. When developer passkeys are loaded, agents operate with provable safety invariants and clear economic bounds.