# Agent Identity

> How Whisper gives an agent, host, device or vehicle one routable IPv6 address as its identity, and how anyone checks it with no account.

*Source: https://www.whisper.security/docs/identity*

---
Every agent, host, device and vehicle on Whisper holds one routable IPv6 `/128` from `2a04:2a01::/32`, announced by AS219419. The address is the identity: the name, the reverse record, the certificate pin and the public registry entry are all derived from it and published together, so a stranger can read the whole answer with stock tools and no account.

Point `dig` and `curl` at an address and you get the name it claims and a verdict on whether the two agree:

```bash
dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
curl -s "https://rdap.whisper.online/verify-identity?ip=2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"
```

Start with [the address itself](/docs/identity/address), which is where the name comes from and why the forward and reverse records have to agree. From there, [create one](/docs/identity/create) and [read the verdict on it](/docs/identity/verify). [The proof chain](/docs/identity/proofs) lists every record behind that verdict, and you can [re-derive the lot on your own machine](/docs/identity/trustless) from the DNSSEC root. When an identity has to go, [revoking it](/docs/identity/revoke) withdraws the address, the DNS records, the pin and the egress credential in one step.

The rest of the chapter covers what an identity carries and where it is published: the [cryptographic material and the records that pin it](/docs/identity/keys), the [public registry](/docs/identity/registry) that answers for each allocation, and the [transparency log](/docs/identity/transparency) that records every issuance. An agent that egresses behind another gets a [nested edge](/docs/identity/nested) on both. [Delegate an apex you already control](/docs/identity/own-domain) and the names move under your own brand.

Two shapes sit beside the agent identity. A phone or a laptop takes a [resolve-only identity](/docs/identity/devices) that answers DNS and nothing else. A car or an ECU takes [one derived from its hardware key](/docs/identity/vehicles), so the same VIN and the same key always land on the same address.

Once an identity exists, [the network chapter](/docs/network) governs what it may reach and [the control plane](/docs/control-plane) is where you mint, read and cut it.