PRIVATE.ME / xLink vs API Keys

xLink vs API Keys

Why identity-based connections replace static credentials for AI agents and M2M systems.

The problem with API keys

API keys are static secrets. Once issued, they persist indefinitely unless manually rotated. 44% of enterprises use static API keys for AI agents. The result: $87 billion in API breaches annually, doubling year-over-year.

Every API key is a liability:

Keys stored in environment variables, config files, CI/CD pipelines — each a leak vector
Rotation requires coordination across every system that uses the key
A leaked key grants access until it's discovered and rotated
No cryptographic proof of which agent made a request
AI agents using static keys cannot be individually identified or revoked

How xLink works

xLink replaces API keys with Decentralized Identifiers (DIDs) backed by Ed25519 signing and X25519 key agreement. Every system and AI agent gets a unique cryptographic identity at creation. No secrets are issued, stored, or rotated.

Authentication is a cryptographic handshake, not a secret comparison:

Each agent's DID is self-certifying — did:key:z6Mk... — no registry required
Every request is signed with Ed25519 — verifiable, non-repudiable
Key agreement uses X25519 ECDH — forward-secret per session
Access revocation is cryptographic — remove the DID from the trust registry, access ends immediately

Side-by-side comparison

Property	API Keys	xLink (DIDs)
Secret storage	Required — env vars, vaults, configs	None — the DID is public, the private key never leaves the agent
Rotation	Manual, coordination-heavy, error-prone	Not required — ephemeral keys per session
Revocation	Requires reissuing a new key to all valid parties	Remove DID from trust registry — immediate, cryptographic
Agent identity	Keys are shared — no per-agent accountability	Every agent has a unique DID — individually identifiable and auditable
Leak impact	Full access until discovered and rotated	Private key never transmitted — nothing to leak
Forward secrecy	Not provided	X25519 ECDH — each session uses ephemeral key material
Post-quantum	Not provided	X25519 + ML-KEM-768 hybrid KEM (FIPS 203) deployed
Audit trail	Key ID only — cannot distinguish agents sharing a key	DID-signed requests — tamper-evident, per-agent attribution
AI agent support	Static tokens — no lifecycle management	Native — each agent gets a DID at creation, ~50µs

What xLink replaces

REST API keys → Identity-based auth (DIDs)
SSH keys → Cryptographic DID handshake
Bearer tokens → Ed25519-signed requests
Static M2M credentials → Per-session ephemeral key agreement
AI agent tokens → Verifiable DID per agent, individually revocable

Getting started

npm install @xail/agent-sdk

const agent = await Agent.create();
console.log(agent.did);
// did:key:z6MkhaXg... — no API key required

Each agent gets a DID automatically. No key issuance, no secret storage, no rotation schedule.