use-link-identity

Link identity

These commands are in beta and appear in link-cli identity --help without a preview flag. Use them when a service accepts Link attestations or signed user claims.

Service requests	Command	JSON field → HTTP header
A Link Agent Attestation Token (AAT), often via WWW-Authenticate: PrivateToken	identity attestations pop	authorization → Authorization
Signed claims, often via WWW-Authenticate: Identity-Presentation	identity credentials present	presentation → Identity-Presentation

An AAT proves issuance by Link without disclosing user claims. A presentation discloses selected claims and proves possession of the credential's holder key for an audience and nonce. If the service requires both, send both headers.

Setup and handling

Use Link Agent Wallet v0.27.0 or later. Check link-cli --version; if older or missing, install or update with npm install -g @stripe/link-cli@latest. No LINK_IDENTITY_COMMANDS flag is needed. See wallet setup; reuse the create-payment-credential skill's authentication guidance.

• Identity commands are available through the CLI, not its MCP tools.
• Only request needs Link authentication. list, pop, and present use local files. Requests return paths and metadata; pop and present return proofs.
• Capture stdout with --format json, parse it programmatically with a JSON parser or jq, and pass the exact proof to the HTTP client or browser automation. Never manually transcribe, reconstruct, or re-encode tokens or presentations. Keep proofs, private keys, and claim values out of transcripts and logs; use restrictive permissions for handoff files.
• Cached identity files belong to the home directory. Changing --auth or logging in as another user does not switch the cached identity. Use separate home directories for different users.