Owner Accounts

Every agent is controlled by one NEAR account, called the owner account. That account installs the agent’s policy on-chain and is the only one that can change it. What the owner account is depends on how the owner signs:

Owner signs with	Owner account	Example
NEAR wallet	The owner’s own NEAR account	`alice.near`
EVM wallet	A NEAR account derived from the owner’s EVM public key	`0sf1117a98eed47ae8e152cb619ad12aea5d483ce2`
Passkey	A NEAR account derived from the passkey’s public key	`0s061dfb216c49c86a47ef98027a6eccefafd6839f`

EVM and passkey owners don’t need a NEAR wallet or any NEAR tokens. They keep signing with the wallet or passkey they already use.

New agents currently take NEAR or passkey owners. EVM owners are gated: unless the deployment has turned them on, agent_create with an EVM owner is refused with owner_type_unsupported (400). Check supported_owner_types in GET /v1/network before you offer EVM sign-up. Existing EVM-owned agents are not affected and keep working.

The owner account is a different thing from the agent’s wallet. The agent has its own wallet and its own NEAR Intents account, which holds its funds. The owner account only controls the agent’s rules. GET /v1/agents/{agent_id} returns both: owner_account and wallet.

What to pass as the owner

You always pass the owner’s public key, never just an address. For a NEAR owner, that’s one of their account’s keys. An EVM address or a 0s account on its own doesn’t prove which key controls it, so the API doesn’t accept one as an owner.

NEAR
EVM
Passkey

{
  "type": "near",
  "account_id": "alice.near",
  "public_key": "ed25519:YOUR_FULL_ACCESS_PUBLIC_KEY"
}

public_key must be an ed25519 full-access key on that account. A key that is missing from the account or is a function-call key is refused with owner_key_not_full_access (403).
Owner requests are signed with this same key. A signature from a different key on the same account is refused: signer_mismatch (409) for a signed message, policy_delegate_owner_mismatch (403) for a delegate action. See Errors.

{
  "type": "evm",
  "address": "0xyour_lowercase_address",
  "chain_id": 1,
  "public_key": "0xUNCOMPRESSED_SECP256K1_PUBLIC_KEY_WITHOUT_04_PREFIX"
}

public_key is 64 bytes as lowercase hex, without the 04 prefix.
address must be the address of that key, in lowercase. If they don’t match, you get evm_public_key_mismatch.
The derived account depends only on public_key. The same wallet gets the same 0s account whichever chain_id you pass.
chain_id is a positive integer, such as 1.
Only regular wallets (EOAs) work. Smart contract wallets (EIP-1271) have no key to derive from.
New EVM-owned agents are accepted only on deployments that have enabled EVM owners. Otherwise agent_create returns owner_type_unsupported. Agents that already have an EVM owner keep working.

EVM wallets don’t share their public key directly. Recover it from any message the owner signs, such as your Sign-In with Ethereum message. Do this on your backend:

TypeScript (viem)

import { hashMessage, recoverPublicKey } from 'viem';

// `message` and `signature` come from the owner's personal_sign, e.g. your SIWE sign-in.
const uncompressed = await recoverPublicKey({ hash: hashMessage(message), signature });

const owner = {
  type: 'evm',
  address: address.toLowerCase(), // the address that signed the message
  chain_id: 1,
  public_key: `0x${uncompressed.slice(4)}`.toLowerCase(), // drop "0x04"
};

Store the public key with your user, next to their address, so you don’t need to ask for another signature later.

{
  "type": "passkey",
  "credential_id": "BASE64URL_CREDENTIAL_ID",
  "public_key": "BASE64URL_DER_SPKI_P256_PUBLIC_KEY",
  "rp_id": "app.example.com",
  "origin": "https://app.example.com"
}

public_key must be an ES256 (P-256) key in SPKI format, base64url-encoded. A COSE key isn’t accepted.
credential_id, rp_id and origin tell the owner’s device which passkey to use and for which site.
origin is your site’s exact HTTPS origin. rp_id is its hostname, or a parent domain of it.
The passkey must verify the user, for example with Face ID or a PIN. Passkey prompts inside an iframe from another site are refused.

Many WebAuthn server libraries return the public key in COSE format after registration. Convert it to SPKI before you pass it:

TypeScript (Node.js)

import { createPublicKey } from 'node:crypto';
import { convertCOSEtoPKCS } from '@simplewebauthn/server/helpers';

// `cosePublicKey` is credential.publicKey from verifyRegistrationResponse.
function spkiFromCose(cosePublicKey: Uint8Array): string {
  const point = convertCOSEtoPKCS(cosePublicKey); // 0x04 || x || y
  return createPublicKey({
    key: {
      kty: 'EC',
      crv: 'P-256',
      x: Buffer.from(point.subarray(1, 33)).toString('base64url'),
      y: Buffer.from(point.subarray(33, 65)).toString('base64url'),
    },
    format: 'jwk',
  })
    .export({ format: 'der', type: 'spki' })
    .toString('base64url');
}

See Passkey registration for the registration settings.

EVM and passkey owners: `0s` accounts

For EVM and passkey owners, the API derives a NEAR account from the owner’s public key. These accounts start with 0s, followed by 40 hex characters.

The account is computed from the public key

The account is a small wallet contract on NEAR with a deterministic address (NEP-616). The address is a hash of the wallet code plus the owner’s public key, so anyone can compute it, and the same key always gives the same account.

The API creates it on the first signature

When the owner signs agent_create, the API checks the signature, then creates the account on NEAR in the same sponsored transaction that installs the policy, if it doesn’t exist yet. The API pays the gas and storage. See Gas.

Only the owner's key can use it

The account accepts only requests signed by the owner’s key: EIP-712 signatures for EVM, WebAuthn signatures for passkeys. Neither you nor the Agent API can sign for it. See Signing Standards.

Owner	Wallet contract code	Owner key in the account
EVM	`eip712-wallet-contract.trezu.near`	`secp256k1:…`
Passkey	`0saf343be226341c0eca7dba6d0b29d49bdff3ad03` (NEP-616 P-256 wallet)	`p256:…`

If the account already exists

The same key always maps to the same 0s account, so the account may already be on NEAR, for example because the owner already uses this wallet for another agent. In that case, the API checks that the account runs the expected wallet code and uses it as it is. It doesn’t create it again. If an account exists at that address with different code, agent_create fails with wallet_code_mismatch.

Find the owner account

GET /v1/agents/{agent_id} returns the owner account in owner_account. It’s null until the agent is ACTIVE:

{
  "owner_account": {
    "account_id": "0sf1117a98eed47ae8e152cb619ad12aea5d483ce2",
    "public_key": "secp256k1:…",
    "authority": "wallet"
  }
}

For NEAR owners, owner_account.account_id is the owner’s own account.

Keys can’t change

The owner account is fixed when the agent is created:

For EVM and passkey owners, a different key means a different 0s account. If the owner switches wallets or loses their passkey, the agent stays controlled by the old key.
For NEAR owners, the agent stays tied to the account and key given at creation.

There is no way to change an agent’s owner or recover a lost key. Tell owners to keep access to the wallet or passkey they sign with, and to withdraw funds before they switch.

Errors

Code	Status	What to do
`evm_public_key_mismatch`	409	`address` isn’t the address of `public_key`. Recover the key again from a signature by that address.
`wallet_code_mismatch`	409	An account exists at the derived `0s` address with unexpected code. This key can’t own an agent.
`wallet_code_untrusted`	409	The wallet contract code on NEAR didn’t match what the API expects. Contact support.
`wallet_rpc_unavailable`	503	The API couldn’t reach NEAR to check the account. Retry shortly.
`owner_type_unsupported`	400	This deployment doesn’t create new agents for this owner type. By default that is `evm`: use `near` or `passkey`, and read `supported_owner_types` from `GET /v1/network`.
`owner_key_not_full_access`	403	The NEAR `public_key` isn’t a live full-access key on `account_id`. Pass a full-access key of that account.
`signer_mismatch`	409	A signed message or passkey assertion came from a different key than the owner’s. Sign with the key you passed in `owner`.
`policy_delegate_owner_mismatch`	403	A NEAR delegate action was signed by a different account or key than the owner’s. Sign with the account and key you passed in `owner`.

Agent API

Quickstart

Guides

Trust & Verification

API Reference

What to pass as the owner

EVM and passkey owners: `0s` accounts

If the account already exists

Find the owner account

Keys can’t change

Errors

​What to pass as the owner

​EVM and passkey owners: 0s accounts

​If the account already exists

​Find the owner account

​Keys can’t change

​Errors

What to pass as the owner

EVM and passkey owners: `0s` accounts

If the account already exists

Find the owner account

Keys can’t change

Errors