The Authenticator

The HexaEight Authenticator is where a person’s identity lives. It runs on Android and iOS.

Everything an agent does traces back to it. An agent takes the identity of a resource; that resource is assigned to your identity; and that identity is yours alone. That chain is what makes the owner of any agent provable.

A note on wording

The app calls what you create an identity, and lists them under Identities. Older material — and the vault icon you may see — calls the same thing a vault. They are the same: an email address, protected by a password, that holds your resources.

Getting started? Step 1 is the short version: install the app, create an identity, add a resource. This page is the full reference — every screen, agent tokens, and approving a licence.

Creating your identity, screen by screen

Two steps, a couple of minutes.

1 · Create your identity

Enter your email address. This is what your identity is derived from, and everything else follows from it — so use an address you intend to keep.

A display name is optional. It is a label for your own use — Work, Personal — and it hides your email address on screen.

Choose the address carefully

The app is explicit about this: “Use a real, permanent email — temporary addresses aren’t allowed. An identity can’t be deleted without reinstalling the app, so double-check the address.”

2 · Verify it and set a password

One email check proves the address is really yours, then you set a password to protect the identity.

A verification code arrives from [email protected] — check spam if you do not see it. The email contains a QR code:

• Scan it from another device, or
• if you are reading the email on the same phone, tap the link below the QR code and the app finishes automatically.

Note

At most three verification emails can be sent, so do not request them repeatedly.

That is your identity created. It lives on this phone, and it is what everything else hangs off.

Resources — giving agents and devices an identity

The app puts it well:

Your identity isn’t just for logging in — it’s the starting point for giving everything else an identity too.

Create a Generic Resource for an app, AI agent, IoT gadget or door lock you authorize to act for you; create a Domain Resource for your websites and servers. Each becomes a trusted, verifiable entity — and you can grant or revoke that trust whenever you like.

When hexaeight-activate newtoken asks for a resource name, this is what it means. The agent takes the identity of that resource, and the resource is assigned to you.

Generic resource

“Let apps act on your behalf.” The platform derives the name from your email address:

web0-still-copper-lake18
└──────┬───────┘ └──┬──┘
   always yours    varies

The first three words are derived from your email, so they are the same every time you create one. The fourth comes from a fixed list and changes per issuance.

This is why names cannot be squatted. They are not first-come-first-served — the prefix belongs to your address, so nobody else can ever claim a name in your space. Once you use one, it is yours.

Generic resources need nothing set up. This is the normal choice.

Domain resource

“Admins only — needs DNS access.” A resource on a domain you control, like agent01.yourcompany.com.

Two things gate it, and both matter:

Your identity’s email must be on that domain. An identity registered at [email protected] may add agent01.yourcompany.com. An identity on a different domain cannot — the platform refuses. You cannot claim a domain you have no address at.

A TXT record proves it. When you add the resource the app gives you a DNS TXT record to publish.

When the TXT record is actually checked

Not when you add the resource — when a licence is granted. Every agent needs a licence, and you authorise one by scanning a QR code in the app. At that moment the platform checks the record. No record, no licence. So an unproven claim sits there doing nothing; it does not become a working identity until DNS backs it.

Use a domain resource when the name matters to whoever is calling — an agent your customers or partners reach should look like yours.

Agent token

Listed in the app as Captcha Token. It is what lets a browser, SPA or user SDK authenticate itself to an agent.

The mechanism is simpler than it sounds, because your phone and the agent already have an encrypted channel between them — they both have HexaEight identities, so they can talk directly. Everything else follows from that.

It works the way a login code does, and you have done this before.

You read the code on your phone and type it into the app. Same shape as any login code, and the reason it works is the same: the code arrives on a device only you hold.

The app never receives the code from anywhere except you. It cannot request it, cannot guess it, and cannot obtain it by compromising the agent — the platform sends it to your phone and nowhere else.

So the app gets in because you were there and vouched for it, not because it was holding a secret that could have been stolen.

Approving a licence

This is the step in Deploy an agent that needs a person.

The licence is bound to that machine. hexaeight.mac is machine-bound and must never be copied to another machine — to share one licence between programs on the same machine, hardlink it.

Which do I need?

You want	Use
An agent for yourself, on your own machine	Generic resource
An agent your customers or partners reach by name	Domain resource — you will need DNS access
A browser app or SPA that talks to your agent	Agent token

You can hold as many as you like under one identity. Set one as the default so authentication uses it automatically.