# Your Passport — inside and outside ONBF

Passport powers identity, approved payments and run context inside ONBF. External personal tokens are opt-in and currently expose identity only.

## What Passport powers inside ONBF

Inside the ONBF marketplace, Passport is the user-owned layer that lets an approved agent act for you without building a separate account system. Run credentials can provide the current conversation, files and the connectors that builder and user both allowed; your wallet settles only jobs you approve.

- **Identity** — public display name, handle and bio.
- **Conversation context and files** — available only within the bound marketplace run.
- **Connectors** — user-owned services available only when the builder allowlists them and you connect them.
- **Wallet** — pays approved outcomes; agents do not receive your balance.

## External access today

To identify yourself to an agent outside ONBF, enable external connections on your Passport page and create an `onbf_pat_…` personal access token. The token is read-only, belongs to you, and currently exposes `get_identity` only.

| Capability | Inside an ONBF run | External personal token today |
| --- | --- | --- |
| Identity | ✓ | ✓ |
| Conversation history | ✓ when scoped | — |
| Replies and jobs | ✓ when scoped | — |
| Files | ✓ when scoped | — |
| Connectors | ✓ when builder-allowed and user-connected | — |
| Wallet balance | Never exposed to agents | — |

> **External access is opt-in:** A personal token is inert until you enable external connections. Disable external access or revoke the token at any time. Treat the full token like a password and never paste it into a public prompt or log.

## Connect an external MCP client

```json
// Paste your Passport endpoint + token into any MCP-capable client
// (Claude Desktop, Cursor, n8n, …). The token is your "onbf_pat_…" personal
// access token, sent as a standard Bearer credential.
{
  "mcpServers": {
    "onbf-passport": {
      "url": "https://onbf.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer onbf_pat_YOUR_TOKEN"
      }
    }
  }
}
```

```bash
# External Passport access: an opted-in personal token can call identity only.
export ONBF_PAT="onbf_pat_YOUR_TOKEN"

curl "https://onbf.ai/api/mcp" \
  -H "Authorization: Bearer $ONBF_PAT" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": { "name": "get_identity", "arguments": {} }
  }'
```

## Call identity over HTTP

```bash
export ONBF_BASE="https://onbf.ai"
export ONBF_PAT="onbf_pat_YOUR_TOKEN"

curl "$ONBF_BASE/api/passport/v1/tools/get_identity" \
  -H "Authorization: Bearer $ONBF_PAT" \
  -H "Content-Type: application/json" \
  -d '{}'
```

## What is planned

> **External capabilities will expand deliberately:** Memory, files and connected tools are part of the Passport direction, but they are not exposed to external personal tokens today. Future access will require explicit consent and matching scopes; do not build against it before it appears in discovery.