Skip to main content

Verifying a badge

This page is for the other side of VIA ID: not the developer badging their own agent, but anyone who's been handed an agent — or found a short code, QR code, or verify link — and wants to check it before trusting anything it says about itself.

Three ways to check a badge​

  • Paste the short code or link into viaid.ai's "Read a Badge" box. No account, no install — this is the fastest path for a one-off check.
  • Open the verify link or scan the QR code directly — viaid.ai/a/<short_code>. Both point at the same server-rendered verify page.
  • Run viaid verify <agent_id> from the CLI if you have the badge file itself and want a structured, scriptable result instead of a rendered page — see the CLI reference.

All three run the same verification logic — a browser-minted badge and a CLI-minted badge are interchangeable, and the checks themselves are identical either way (see Badge schema for exactly what each of the six steps checks).

Finding the agent's ID​

Before you can check a badge, you need the agent's ID (a via_... hash) or its short code. Today, VIA ID supports one concrete mechanism for this:

HTTP headers, if the agent's integrator wired them in. An agent that presents its badge (see Integrate your agent → Phase 2) sends two response headers:

X-VIA-ID-Agent: via_...
X-VIA-ID-Verify-URL: https://viaid.ai/a/<short_code>

If you're inspecting an API response, a system card, or a marketplace listing, look for these.

For a conversational agent — one you're just talking to in a chat window — there's a second, narrower mechanism: an announceLine() helper (see Integrate your agent → Announce yourself in conversation) an integrator can wire into the agent's system prompt, or call directly when asked "what's your VIA ID." It returns one fixed sentence — My VIA ID is <code> — verify at https://viaid.ai/a/<code>. — so it can be found by a simple pattern match. This is opt-in per integrator, not automatic or universal — plenty of conversational agents won't have it wired in. If an agent doesn't volunteer this line and you need its ID, ask the agent's operator directly, or check whatever channel they've chosen to publish it in (a footer link, an about page, and similar).

Reading the verdict​

A verify call returns one of five states — see Introduction for exactly what each one means. Two things worth calling out before you act on a verdict:

  • VALID is not a safety or compliance claim. It means the identity, signatures, and hash-chained log all check out — see Claims & terminology for exactly what it does and doesn't attest to.
  • Coverage matters as much as the verdict. If the badge has no evidence attached, it's identity + log only — no capability has been independently evaluated. If it does, the coverage field names exactly what was checked, never "everything."

What you can do with the result — without VIA ID vs. with VIA ID​

Without VIA ID: you're taking the agent's own word, or its operator's word, for what it did and who it is. There's no independent, checkable record — if something goes wrong, there's nothing to verify against after the fact.

With VIA ID, once you've verified: you have a cryptographically checkable record of the agent's identity and every logged action — checkable offline, without trusting VIA ID, the agent, or its operator, because you're checking signatures and a hash chain, not taking anyone's word. If the badge carries evaluated capability evidence, you see exactly what was confirmed and what explicitly failed, never a blanket "this agent is safe" claim. What you do with that result is still your call — gate on it, log it, require a minimum assurance tier before granting access. VIA ID reports the verdict; it doesn't make the trust decision for you.

FAQ​

See the verifying-a-badge section of the FAQ for specific questions (can a badge be faked, do I need to trust VIA ID the company, and more).