# Why should an AI agent have its own identity instead of a shared login?

*2026-10-21 · By Naol Ketema, founder of Agent Identity*

**Short answer:** Because a shared login makes every agent look the same: you cannot tell which agent did something, limit what one agent can reach, or stop one without stopping all of them. An agent identity gives each agent its own name, address, keys and history, so its actions are attributable, its access is scoped, and it can be suspended on its own.

## What an agent identity is

An agent identity is a named account that belongs to one software agent, with its own addresses and credentials, separate from the humans and other agents in the organization. It is the agent equivalent of an employee having their own email and badge instead of borrowing someone else's.

On Agent Identity, every agent has a handle, a display name, a mailbox that is created the moment the agent is, zero or more API keys, and optionally a vault public key. It can also hold a phone number and take part in Agent2Agent messaging.

## What goes wrong with shared logins and keys

The common starting point is one Gmail account, one SendGrid key or one Twilio number used by every agent and script. It works until something goes wrong.

- No attribution: an email went to the wrong customer. Which agent sent it? The logs say the shared account did.
- No scoping: every agent can read every other agent's mail and use every capability the shared key has.
- No targeted shutdown: to stop one misbehaving agent you rotate the shared key and break every other agent with it.
- No clean history: replies, bounces and calls for different agents land in one place and have to be untangled.
- A larger blast radius for prompt injection: an agent tricked by an inbound message acts with the full power of the shared account.

## What a separate identity gives you

- Accountability: actions are recorded against the agent that took them, in an append-only event log.
- Least privilege: an agent key reaches only its own agent. Another agent's mailbox reads as 404, events and webhooks are limited to its own, and it cannot create agents or manage keys.
- A kill switch: suspension stops one agent, with a required reason, and can be reversed.
- Separate reputation: replies, bounces, contacts and access rules belong to that agent.
- A stable address others can trust: the handle and mailbox stay the same when the display name changes.

## Create an agent and give it its own key

Use the org key to create the agent and mint a key bound to it. Give the running agent only that key; keep the org key for administration.

```ts
import { AgentClient } from "@agentidentity/sdk";

const org = new AgentClient({ baseUrl: "https://api.agent-identity.dev", apiKey: process.env.AID_ORG_KEY! });

const agent = await org.identities.create({ handle: "support", displayName: "Support" });
agent.mailboxAddress; // support@...

const { key } = await org.apiKeys.create({ name: "support runtime", identityId: agent.id });

const asAgent = new AgentClient({ baseUrl: "https://api.agent-identity.dev", apiKey: key });
await asAgent.whoami(); // actorType tells you this is an agent key
```

## Stopping one agent without touching the rest

Suspension is the kill switch. It needs an org key, an agent cannot suspend or reinstate itself, and reason is required, because a suspension with no stated cause is useless to whoever reads the audit trail later.

```bash
curl -sS -X POST "https://api.agent-identity.dev/v1/identities/$AID_AGENT/suspend" \
  -H "authorization: Bearer $AID_ORG_KEY" \
  -H 'content-type: application/json' \
  -d '{"reason":"Sending to unverified recipients"}'
```

POST /v1/identities/{id}/reinstate lifts it. GET /v1/identities/suspensions returns the history with reason, who suspended, when, and who reinstated. There is no delete: suspension stops the agent without losing its history.

The identity is also what every channel hangs off, so the same agent is recognisable wherever it shows up:

- Email: the mailbox address is derived from the handle and the sending domain. Pass a verified custom domain on create to put it on your own domain.
- Phone: the agent can hold one voice number, and its calls, transcripts and access rules belong to it.
- Agent2Agent: the handle is its address for other agents, and its description and picture appear on its agent card.
- Events: what it sends, receives and is asked to do lands in the event log against it.

## Moving off a shared login

- Step 1: list every agent and script using the shared account, and what each one sends or reads.
- Step 2: create one agent identity per agent, with a clear handle and display name.
- Step 3: mint an agent key for each and deploy it to that agent only.
- Step 4: move each agent's outbound mail, calls and webhooks to its own identity, one at a time.
- Step 5: retire the shared credential once nothing uses it.

## When a shared identity is fine

A single internal script that sends a nightly report to your own team does not need its own identity. Separate identities pay off once you have more than one agent, once agents talk to people outside your organization, or once you need to explain later what an agent did. We run our own sales agent on Agent Identity for exactly these reasons: it emails strangers, so its mail, replies and rules need to be its own.

## FAQ

### Is an agent identity the same as a service account?

It is similar: a non-human account with its own credentials. An agent identity also comes with the channels an agent uses to talk to the world, such as a mailbox, and optionally a phone number and an Agent2Agent address.

### Can I delete an agent?

Not on Agent Identity. Suspend it instead, which stops sending and receiving without losing history, and reinstate it if needed.

### Can an agent rename itself?

An agent key can change its own agent's display name and description. The handle and mailbox address stay the same, and the change is recorded as identity.updated.

---
Docs: https://www.agent-identity.dev/docs · All guides: https://www.agent-identity.dev/guides · llms.txt: https://www.agent-identity.dev/llms.txt