Wayleave Core

Know which AI agents cross your API — verified by signature, not guessed from an IP.

Wayleave Core is the identity and policy layer of the platform: identity, verification, classification, policies, metering and HTTP 402 — the path every request takes before your route runs. It ships as zero-dependency open-source middleware and as a hosted Identity API.

Get started free npm install wayleave

Four lanes for every request

verified_agent

A valid Ed25519 HTTP Message Signature (RFC 9421, compatible with Web Bot Auth) against a key directory you trust.

declared_agent

Identifies itself as a bot or AI agent, but carries no valid signature.

suspected_bot

Automation fingerprints without disclosure. An invalid signature lands here too — faking verification is the strongest fraud signal there is.

human

Browser-shaped traffic. Nothing gave it away — humans are never charged.

The Core pipeline

Identity — read what the client says about itself and any signature it carries.
Verification — Ed25519 over an RFC 9421 signature base, against key directories you trust.
Classification — one of four lanes: verified agent, declared agent, suspected bot, human.
Policies — allow, deny or rate-limit per lane and route.
Metering — every crossing recorded through a hook that never blocks serving.
HTTP 402 — priced routes return an x402-shaped Payment Required challenge to agents.
Settlement — confirmed by your payment verifier; Wayleave takes 0%.

Signed policy, enforced at your origin

Rules you set in Wayleave Meter are published as a signed policy document. The gate fetches it on a timer, verifies the signature, and evaluates from memory — never a network call inside a request. If Wayleave is unreachable, your traffic is unaffected: the last good policy keeps running.

Honest guarantees

Wayleave prices disclosure; it does not detect concealment. A bot that sends a browser user-agent and accept-language header reaches the human lane — set strictPricedPaths: true on anything you charge for, so only a verified signature (or your own confirmHuman check) crosses a priced route.

Rules, rate limits and pricing

import Wayleave from 'wayleave';
import { coinbaseFacilitator } from 'wayleave/x402';

const gate = new Wayleave({
  rules: {
    verified_agent: [['/api/admin', false], ['/api', true]],
    suspected_bot:  [['/api', false]],
  },
  rateLimits: { declared_agent: 10 },
  pricedPaths: { '/api/premium': 0.05 }, // agents pay 5¢/call, humans free
  strictPricedPaths: true,
  verifyPayment: coinbaseFacilitator({ /* your keys */ }),
});
app.use(gate.express());

Questions

Is Wayleave Core open source?

Yes. The middleware is the open-source wayleave package on npm with zero dependencies — Node's native crypto only.

Does traffic route through Wayleave?

No. The middleware runs in your own process, and the Identity API stores nothing — your traffic never routes through Wayleave.