QueryZero

Agent Credentials

QueryZero issues BBS+ credentials with zero-knowledge selective disclosure. Get a credential once, then derive proofs that reveal only the claims each service needs to see — wallet address, KYC status, Farcaster identity, staking balance — without exposing the rest.

Prove your wallet

Request a nonce, sign it with your wallet key. QueryZero issues a BBS+ credential with 16 claims including attestation slots.

Derive ZK proofs

Choose which claims to reveal. Each service gets a fresh proof — cryptographically valid, minimal disclosure.

Present to services

Add X-Agent-Credential header to any request. Services verify against our public key. No call home.

# Step 1: Request credential (returns nonce to sign)
$ curl -X POST https://queryzero.net/api/v1/agents/my-agent/credential \
  -H "Content-Type: application/json" \
  -d '{"wallet_address": "0x...", "operator": "mydomain.com"}'
{"nonce": "qz-agent-a7f3...", "message": "Sign this nonce..."}

# Step 2: Submit signature, receive BBS+ credential bundle (16 messages)
$ curl -X POST https://queryzero.net/api/v1/agents/my-agent/credential/verify \
  -d '{"nonce": "qz-agent-a7f3...", "signature": "0x..."}'
{"credential": {"type": "QueryZeroAgentIdentity", "messageCount": 16, ...}}

# Step 3: Test your proof at echo (free)
$ curl -X POST https://echo.queryzero.net/echo \
  -H "X-Agent-Credential: <base64 proof>"
{"proof_valid": true, "claims_disclosed": 2, "wallet_matched": true}

Extensible Attestations

Credentials include auto-verified claims: Coinbase KYC, USDC blacklist status, wallet age, Farcaster identity, and Moltbook verification. Each provable via ZK proof without revealing the others.

Test Your Credentials

echo.queryzero.net — free credential mirror. Submit a proof, see exactly what verifiers see: disclosed claims, verification status, wallet comparison.

Service Credentials — "Flip the Script"

Services get the same BBS+ credentials as agents. Prove domain ownership, compliance status, or payment capability — without revealing everything else. Mutual ZK authentication for every transaction.

Request credential

POST your domain. Get a DNS challenge nonce to prove domain ownership.

Add DNS record

Add a _qz TXT record. Same convention as service discovery — one DNS touch.

Verify & receive

Domain verified, safety checked (Google Safe Browsing), attestations auto-run. BBS+ credential issued with 16 claims.

Service Discovery

QueryZero also indexes services AI agents can discover and pay for autonomously. Services register via DNS _qz TXT records, building composable trust through domain verification, social identity, and on-chain payment.

DNS-based trust

Services prove domain ownership by adding a _qz TXT record. No accounts, no keys — only the domain owner can do it.

Independent verification

Any agent can check _qz.{domain} to see if a domain declares services. A quick check that doesn't depend on us.

# Search for services
$ curl https://queryzero.net/api/v1/search?q=postal+mail

# Does this domain declare agent services?
$ dig TXT _qz.invoices.org +short
"v=qz1; id=38460020; services=postal-mail; endpoint=https://invoices.org/api/x402; op=queryzero.net"