# GoldKey Guard — Network Authorization Endpoint

> GoldKey Guard — Network Authorization Endpoint is a paid API for AI agents from goldkey-edge-storefront.noah-ing.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Issues cryptographically signed authorization receipts for AI agent tool calls (MCP tools or HTTPS operations) before they are executed, enforcing operator-signed policy and returning an ALLOW/REVIEW/BLOCK decision.

## Facts

- Endpoint: POST https://goldkey-edge-storefront.noah-ing.workers.dev/v1/guard/paygo/authorize/network
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/goldkey-guard-network-authorization-endpoint-dc829961
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_13VjuEnURTXvBAu0Uc20f

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability goldkey-guard-network-authorization-endpoint-dc829961 -d '<json body>'
```

Example prompt: Before my AI agent calls the 'send_email' MCP tool on connector 'email-connector-01', I need GoldKey Guard to authorize that call and return a signed receipt — use installation ID gki_abc123... and include the idempotency key 'req-20240601-001'.

## When to prefer this

Use this endpoint when you need a cryptographically verifiable, operator-policy-backed authorization receipt before an AI agent executes an MCP tool call or HTTPS operation. It is the right choice when auditability, non-repudiation, and policy enforcement are required prior to agentic execution — especially in regulated, high-stakes, or multi-operator environments where a bare preflight check is insufficient and you need a signed artifact proving authorization was granted.

## Known failure modes

- Invalid or expired installation_id returns an authorization denial
- Signature verification failure on the request body returns rejection
- Malformed idempotency_key pattern causes schema validation error
- Unsupported call kind or missing required call fields returns 400
- Policy configured by operator blocks the call, returning BLOCK decision with reason_codes
- Replay of an already-used idempotency_key may return cached result or rejection
- Missing or incorrect input_schema_sha256 for mcp_tool calls causes rejection

## How this service works

GoldKey Guard is an execution-path authorization layer for AI agents: operator-signed policy, a customer-controlled local enforcer, and signed receipts before MCP, HTTPS, or supported EVM calls run.

## Output

Returns a signed goldkey.guard-authorization-envelope.v1 JSON object containing: the authorization decision (ALLOW, REVIEW, or BLOCK), reason_codes explaining the decision, a cryptographic signature over the receipt, the SHA-256 hash of the receipt, and a signed evidence object. This receipt must be presented to execute the gated tool call.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "call": {
   "oneOf": [
    {
     "type": "object",
     "required": [
      "kind",
      "connector_id",
      "tool",
      "input_schema_sha256",
      "arguments"
     ],
     "properties": {
      "kind": {
       "const": "mcp_tool"
      },
      "tool": {
       "type": "string",
       "pattern": "^[A-Za-z0-9._:-]{1,256}$"
      },
      "arguments": {},
      "connector_id": {
       "type": "string",
       "pattern": "^[A-Za-z0-9._:-]{1,128}$"
      },
      "input_schema_sha256": {
       "type": "string",
       "pattern": "^[0-9a-f]{64}$"
      }
     },
     "additionalProperties": false
    },
    {
     "type": "object",
     "required": [
      "kind",
      "connector_id",
      "operation_id"
     ],
     "properties": {
      "body": {},
      "kind": {
       "const": "https"
      },
      "query": {
       "type": "object",
       "maxProperties": 100
      },
      "connector_id": {
       "type": "string",
       "pattern": "^[A-Za-z0-9._:-]{1,128}$"
      },
      "operation_id": {
       "type": "string",
       "pattern": "^[A-Za-z0-9._:-]{1,128}$"
      }
     },
     "additionalProperties": false
    }
   ]
  },
  "schema": {
   "const": "goldkey.guard-request.v1"
  },
  "issued_at": {
   "type": "string",
   "format": "date-time"
  },
  "signature": {
   "type": "string",
   "pattern": "^[A-Za-z0-9_-]{86}$"
  },
  "idempotency_key": {
   "type": "string",
   "pattern": "^[A-Za-z0-9._:-]{8,128}$"
  },
  "installation_id": {
   "type": "string",
   "pattern": "^gki_[A-Za-z0-9_-]{43}$"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "schema": "goldkey.guard-authorization-envelope.v1",
  "receipt": {
   "decision": "ALLOW",
   "reason_codes": []
  },
  "evidence": {
   "schema": "goldkey.guard-evidence.v1",
   "decision": "ALLOW",
   "reason_codes": []
  },
  "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  "receipt_sha256": "0000000000000000000000000000000000000000000000000000000000000000"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/goldkey-guard-network-authorization-endpoint-dc829961/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from goldkey-edge-storefront.noah-ing.workers.dev](https://www.zero.xyz/host/goldkey-edge-storefront.noah-ing.workers.dev/llms.txt)