Both buttons spin up a fresh sandbox with the SDK pre-installed and a working index.mjs.

One click forks agentpki/test-agent-template into a cloud IDE with @agentpki/sdk already installed and three demo commands wired up: npm run demo:allow, npm run demo:tamper, npm run demo:revoked — the same trust contract Path 01's labs exercise, but from a real Node project you own.

Open index.mjs — the whole demo is 12 lines.

// index.mjs — pre-wired test agent
import { mintPassport, verify } from '@agentpki/sdk';
import Anthropic from '@anthropic-ai/sdk';

const token = await mintPassport({ sub: 'agent:test/v1' });
const claude = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const resp = await claude.messages.create({
  model: 'claude-3-5-sonnet',
  max_tokens: 200,
  messages: [{ role: 'user', content: 'What is AgentPKI?' }],
});
const verdict = await verify(token);

console.log('claude says:', resp.content[0].text);
console.log('verifier says:', verdict.verdict);

Paste your Anthropic key into the .env, hit ▶ Run. You see Claude's response AND the verifier's verdict in the same terminal.

Same end-to-end behaviour, native syntax for each shell. The Copy button copies only the command — the prompt marker ($ or PS>) is stripped, so you can't paste it by accident.

$ curl -fsSL https://agentpki.dev/bootstrap | sh

PS> iwr https://agentpki.dev/bootstrap.ps1 | iex

Never hide what runs on your machine. Inspect without executing:

bash · preview

$ curl -fsSL https://agentpki.dev/bootstrap

PowerShell · preview

PS> iwr https://agentpki.dev/bootstrap.ps1 | Select-Object -Expand Content

Click Simulate to animate the actual 3-scenario v1.0 output. Every value is what the live bootstrap returns — 6 real HTTP calls in ~1 sec.

In a separate terminal (or paste the token into agentpki.dev/check), run:

$ curl -X POST https://verify.agentpki.dev/v1/verify \
    -H 'content-type: application/json' \
    -d '{"token":"<paste-token-here>"}'

{
  "verdict": "allow",
  "issuer": "mybot.agents.agentpki.dev",
  "elapsed_ms": 47
}

That's end-to-end inside your real project. Your existing agent now carries a verifiable cryptographic identity for every outbound call.

Three assertions. If any stops passing against your prod verifier, the trust system regressed.

// agentpki.test.ts — drop this into your existing test suite
import { describe, it, expect } from 'vitest';

const VERIFY = 'https://verify.agentpki.dev/v1/verify';
const MINT   = 'https://demo.agentpki.dev/mint';

async function verify(token: string) {
  const r = await fetch(VERIFY, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ token }),
  });
  return r.json();
}

describe('AgentPKI trust contract', () => {
  it('allow on a real signed token', async () => {
    const { token } = await fetch(MINT).then(r => r.json());
    const v = await verify(token);
    expect(v.verdict).toBe('allow');
  });

  it('deny + bad_signature on tampered token', async () => {
    const { token } = await fetch(MINT).then(r => r.json());
    const [v, p, p2, f] = token.split('.');
    const tampered = `${v}.${p}.${p2.slice(0, -4)}AAAA.${f}`;
    const result = await verify(tampered);
    expect(result.verdict).toBe('deny');
    expect(result.failure_reason).toBe('bad_signature');
  });

  it('deny + revoked_key when issuer rotated the kid', async () => {
    const { token } = await fetch(`${MINT}?revoked=1`).then(r => r.json());
    const result = await verify(token);
    expect(result.verdict).toBe('deny');
    expect(result.failure_reason).toBe('revoked_key');
    expect(result.failure_detail).toContain('demo-2026-q1-rotated');
  });
});