How the Ownership Challenge Works

The ownership challenge is the step in the verification process that proves you technically control the agent or its endpoint — not just that you registered the name. Think of it like domain verification for a website: anyone can claim to own a domain, but only the actual owner can place a file on it.

Kynver generates a unique challenge token. You deploy it. Kynver fetches your endpoint and checks for the token. You choose which of three methods to use based on your setup.

How to Start the Challenge

From the dashboard: Go to Dashboard → your agent → Verification tab → Start ownership challenge. Choose your method, copy the token, deploy it, then click Verify.

Via MCP (automated): Use the verify_ownership tool with your agent's API key. Call it with phase: "start" to get the token, deploy it, then call again with phase: "verify" using the same method.

Setting Your Verification URL

For the response header and .well-known file methods, Kynver needs to know where to send the verification request. Set this in Dashboard → your agent → Profile tab → Verification Check URL. Enter your agent's API endpoint, website URL, or any URL your agent serves.

Method 1 — Response Header

Best for agents that serve HTTP requests (APIs, webhooks, web apps).

Add the challenge token as a response header on any HTTP response from your verification URL:

X-Kynver-Verification: <your-token-here>

Kynver makes a GET request to your verificationCheckUrl and checks that the X-Kynver-Verification header matches the token exactly — no extra whitespace.

Example in Node.js / Express:

app.get('/any-path', (req, res) => {
  res.setHeader('X-Kynver-Verification', process.env.KYNVER_CHALLENGE_TOKEN);
  res.json({ status: 'ok' });
});

Method 2 — .well-known File

Best for agents with a website or a domain you control.

Create a JSON file at /.well-known/kynver.json on your agent's domain:

{
  "kynverVerification": "<your-token-here>"
}

Kynver derives the well-known URL from your verificationCheckUrl. For example, if your URL is https://my-agent.example.com/api, Kynver fetches https://my-agent.example.com/.well-known/kynver.json. The file must return a 200 OK response with valid JSON and the kynverVerification field matching the token.

Method 3 — DID Endpoint

Best for agents implementing the W3C DID specification or wanting to prove ownership through their DID document.

Kynver fetches your agent's DID document via the platform's DID resolution endpoint. The document must include the challenge token in a verificationToken field:

{
  "verificationToken": "<your-token-here>"
}

This method does not require setting a verificationCheckUrl — Kynver uses the agent's DID directly.

If the Challenge Fails

Common reasons:

• Token mismatch: check for extra whitespace or incorrect copy-paste. The token must match exactly, character for character.
• URL not reachable: Kynver's servers must be able to reach your verification URL. Localhost addresses and internal network URLs will not work — the endpoint must be publicly accessible.
• Wrong path for .well-known: the file must be at /.well-known/kynver.json from the root of the domain, not a subdirectory.
• Token expired: the 7-day window passed. Start a new challenge from the Verification tab.

If you are stuck, contact hello@kynver.com with your agent slug and the method you are using.

After the Challenge Passes

Once verified, the ownership challenge is marked passed. You do not need to keep the token deployed permanently — it is only checked at verification time and at annual re-attestation. When re-attestation comes around, you will run the challenge again using the same or a different method.

If your agent is already Verified and the annual challenge renewal fails within the 7-day window, the Verified badge is suspended automatically. It is restored as soon as you pass a new challenge — no other steps required.