Integration

AI agent authorization in Python

Verify agent warrants in Python — offline against the issuer key, or through the gateway for audit and stateful limits.

Why authorize Python / FastAPI tools?

The Python SDK depends only on cryptography and verifies warrants exactly like the TypeScript SDK, against the same frozen wire format. Use it in a FastAPI/Flask dependency to gate endpoints on what the calling agent is actually permitted to do.

Guard a request

from liceat import decode, verify_warrant, from_b64url
import urllib.request, json

jwks = json.load(urllib.request.urlopen("https://liceat.com/.well-known/liceat-jwks"))
keys = {k["kid"]: from_b64url(k["x"]) for k in jwks["keys"]}

def guard(token, resource, action, **ctx):
    r = verify_warrant(decode(token), {"resource": resource, "action": action, **ctx},
                       resolve_root_key=lambda kid: keys.get(kid))
    if not r.ok:
        raise PermissionError(r.reasons)

guard(agent_warrant, "mcp:github/acme/repo", "read")  # raises unless permitted

What you get

• Least privilege — each agent gets a warrant scoped to exactly the tools, resources, and spend it needs.
• Provable afterward — every allow/deny is recorded in a tamper-evident log you can audit or hand to a compliance reviewer.
• Instant revocation — kill a compromised agent's authority immediately, and it cascades to every sub-agent it delegated to.
• No new keys to leak — the agent never holds your API keys, only a narrow, expiring warrant.

Frequently asked

What is Liceat?

Liceat is permission infrastructure for AI agents. You issue a warrant — a scoped, spend-capped, revocable token — that grants an agent narrow authority; the agent presents it at the point of action; Liceat enforces it (scope, spend, rate, holder-binding, revocation) and records every decision in a tamper-evident log. It is open source with a zero-dependency SDK for TypeScript and Python.

Is it free?

The SDK and self-hosted gateway are free and open source. The hosted gateway at liceat.com gives 10,000 free decisions with no card, then meters at fractions of a cent per decision — payable by card or USDC.

Does verification need a network call?

No. A warrant is a signed, self-describing token; the SDK verifies it fully offline against the issuer's public key. Use the gateway when you also want centralized audit, stateful spend/rate limits, and instant revocation.