Comparison
Agent mandate vs. API key
An API key proves access, not authority: whoever holds it can do everything the key can — without limit, anonymously, until someone rotates it. A mandate proves an instruction: bound to an identity, limited in amount and time, revocable at any moment.
| Dimension | Agent mandate | API key |
|---|---|---|
| Possession = authority? | No — proof of possession plus an identity chain is required | Yes — whoever holds the key acts |
| Limits | Per action, per period, per counterparty | At most rate limits |
| Consequences of theft | A presentation without the key is useless (MD-101/104) | Full access until rotation |
| Attribution | Real legal person via the identity anchor | At best an account |
| Audit | Hash-chained, two-sided evidence | Provider logs |
Verdict
API keys remain right for machine-to-machine infrastructure. As soon as an agent acts with external effect on behalf of a person or company, the API key is the wrong abstraction — it knows neither principal nor limit.