Authentication (Firebase Handshake)
High Limit Designs uses Firebase Authentication as the identity layer for the main website and the agent fleet. Both human users and autonomous agents authenticate through the same Firebase project, visible in the Firebase Console.
The Agent Handshake
Agents do not share user credentials and do not use passwords. They authenticate via a Zero-Trust Handshake that proves possession of a sovereign API key without transmitting it.
Flow
Agent Request → POST https://api.highlimitdesigns.com/v1/auth/handshake
{ "agent_id": "cipher", "nonce": "<cryptographic_random>" }
Gateway Challenge → Returns server_nonce + stored public_key_fingerprint
Agent Signs → Ed25519(nonce_client || nonce_server) with private key
Gateway Verifies → Signature matches public key → Issues Firebase Custom Token
Firebase Trade → Custom Token → signInWithCustomToken() → ID Token + Refresh Token
Agent Uses → Authorization: Bearer <id_token> on all subsequent requests
The private key never leaves the agent runtime. The gateway only stores the public key fingerprint.
Account Types
| Type | Managed By | Firebase Visibility |
|---|---|---|
| Users | Dashboard admins | Auth panel — email/password, MFA, last login |
| Agents | Fleet CLI (fleet/provisioning.md) | Auth panel — Custom claims: agent=true, agent_id=cipher, role=Infra Architect |
Agents appear in the Firebase Auth console alongside users, distinguished by the agent=true custom claim. No separate project or tenant.
Dashboard Control
The CMS Studio Console (internal admin surface) provides:
- Provision Agent → generates Ed25512 keypair, writes public key to The Mind, private key to agent's sovereign volume
- Revoke / Rotate → immediate revocation invalidates all future handshakes; rotation issues new keypair
- Quota & Rate Limits → per-agent enforcement at the gateway layer
- Session Inspection → active Firebase sessions per agent, revocable instantly
Integration Code
Agent Runtime (Go — CyBot)
func Handshake(ctx context.Context, agentID, apiKey string) (string, error) {
// 1. Request challenge
challenge, err := client.Post("/auth/handshake", map[string]string{
"agent_id": agentID,
"nonce": crypto.RandHex(32),
})
if err != nil { return "", err }
// 2. Sign with agent's Ed25519 private key (loaded from sovereign volume)
sig, err := ed25519.Sign(privKey, challenge.ClientNonce + challenge.ServerNonce)
if err != nil { return "", err }
// 3. Submit signature → get Firebase custom token
customToken, err := client.Post("/auth/verify", map[string]string{
"agent_id": agentID,
"signature": hex.EncodeToString(sig),
})
if err != nil { return "", err }
// 4. Exchange for ID token (Firebase Admin SDK or REST)
idToken, err := firebase.ExchangeCustomToken(ctx, customToken)
return idToken, err
}
Python (Fleet SDK)
from hld_mind import auth
async def get_agent_token(agent_id: str) -> str:
"""Full handshake → Firebase ID token. Cached until near-expiry."""
return await auth.handshake(agent_id) # Handles nonce, sign, exchange, cache
Security Notes
- No passwords — agents cannot be phished
- Short-lived ID tokens (1hr) + refresh tokens (7d) — compromise window is bounded
- Revocation is instant — delete custom claim or disable user in Firebase → all gates drop the agent
- Audit trail — every handshake logged to
fleet_noteswithtags: ["auth", "handshake", agent_id]