# Fast Sign Agent Guide

Fast Sign signs any file with a Fast address: the file's SHA-256 fingerprint is settled on-chain,
and anyone can verify the result. In the website flow, the file's bytes never leave the browser; what is
published on-chain is the signed claim — the fingerprint, the signer address, and any attestation
metadata the signer included (a signer name, a file label, listing preferences). Reading and verifying need no account, no key, and no API token.

This deployment settles signatures on the `fast:mainnet` network.

Start with [llms.txt](https://sign.fast.xyz/llms.txt) — it defines what a verified signature proves and what it
does NOT. This guide covers the HTTP surface; that file covers the semantics.
Do not relay a signature as endorsement of a file's content or as verified personhood.

## Agent surface

| Resource | URL |
|---|---|
| Home | https://sign.fast.xyz/ |
| Verify a file | https://sign.fast.xyz/verify |
| Semantics map (llms.txt) | https://sign.fast.xyz/llms.txt |
| API catalog (RFC 9727) | https://sign.fast.xyz/.well-known/api-catalog |
| This guide | https://sign.fast.xyz/AGENTS.md |
| Auth metadata (RFC 9728) | https://sign.fast.xyz/.well-known/oauth-protected-resource |
| Agent skills index (RFC v0.2.0) | https://sign.fast.xyz/.well-known/agent-skills/index.json |
| ARD manifest (agenticresourcediscovery.org) | https://sign.fast.xyz/.well-known/ard.json |

## Public read APIs (no auth)

This origin has ONE read API, and its URL is templated — an RFC 9264 `href` cannot carry an
RFC 6570 template, so it is defined HERE rather than in the API catalog, and that one hop is the
intended discovery path for it:

| Route | Method | Purpose |
|---|---|---|
| /api/fast-id/{address} | GET | Resolve a `fast1…` address to its Fast ID name, proxying this network's directory. Answers `{status:"resolved", name, profileUrl, nameClaimTx}`, `{status:"not-found", createUrl}`, or `{status:"unavailable"}`. Deliberately fail-quiet: an upstream error, timeout, or malformed document answers `{status:"unavailable"}` with a 200 — NEVER proof the address holds no name; only `resolved`/`not-found` are load-bearing. A malformed address is a 400; a saturated concurrency gate is a 503 with `retry-after`. |

The settlement lookups behind `/verify` (SHA-256 → on-chain settlements) are served by a
separate reverse-index service on its own origin, not by this site; the `/verify` page is the
supported way to use them.

## Writes on this origin: none

There is no write API on this origin. Website signing is human-in-the-loop: an Ed25519 wallet
signature is made through a user gesture (the Fast Wallet extension or the app.fast.xyz popup).
This site never holds a key.

For software that already has caller-supplied signing authority, install the public
@fastxyz/sign-sdk@0.1.0 package from [fastxyz/fast-sdk](https://github.com/fastxyz/fast-sdk).
Its [agent usage guide](https://github.com/fastxyz/fast-sdk/blob/develop/packages/sign-sdk/README.md)
explains how to hash any original file, query the current fee on the chosen network,
settle its digest, and read back settlement and index registration. Installing or
importing it does not authorize a signature or fee. After an indeterminate
submission, recover rather than blindly retry. There is no Fast Sign CLI or custodial service.

## Not an identity provider

Fast Sign does not issue tokens, sessions, or assertions about users to third parties, and it is
not an OAuth 2.0 / OpenID Connect provider — there is no authorization server here. The RFC 9728
metadata at `/.well-known/oauth-protected-resource` advertises no authorization servers and no
scopes; the statement that these surfaces are public and that no third-party token exists is made
HERE, in prose — the RFC document points back to this guide for it.

## Crawling policy

See [robots.txt](https://sign.fast.xyz/robots.txt): search and agent-time reading are welcome; model training on
this content is not (`Content-Signal: search=yes, ai-input=yes, ai-train=no`).