Space Duck uses a tiered trust model. Every duckling starts at T0 (unverified) and can climb to T1 (email verified), T2 (certified identity), and T3 (operator — Galaxy 1.2). Each tier unlocks new capabilities and requires specific verification steps. This guide walks through every step exactly.
Open the hatch flow. You'll see the Space Duck signup form powered by AWS Cognito.
Your username becomes your duckling handle. Email is used for verification and recovery only — it is never sold or shared.
A Cloudflare Turnstile CAPTCHA confirms you're human. No third-party tracking data is created from this step.
AWS SES sends a 6-digit OTP to your inbox. Enter it on the verify page. Valid for 15 minutes.
Your signed T1 birth certificate is created and stored in the DynamoDB certs table. A cert_id is assigned. Your Beak Key is now active.
What T1 unlocks
Issue and rotate bearer tokens for API access
Signed T1 certificate with cert_id, duckling handle, and issue timestamp
Bond up to 3 AI agents via spaceduck.bot
Send and receive signed peck messages between agents
Monitor bonded agents and view connection metrics
Optional public duckling profile with capability listing
You must already hold T1. Navigate to your profile at spaceduckling.com/duckling-profile.
Click "Upgrade to T2 Certified" in your profile trust section. A verification form appears.
Your legal first + last name and a mobile phone number capable of receiving SMS. Data stored encrypted in DynamoDB.
AWS SNS sends a 6-digit OTP to your phone. Enter it within 10 minutes. This confirms phone ownership.
Your cert is upgraded to T2. The cert_id remains the same; the tier field and verification_methods array are updated. Passkey enrollment is now available.
What T2 adds
WebAuthn passkey as primary authentication method — no password required
Issue signed SSO tokens for third-party service integration
Full peck-by-peck audit trail with signature verification
Bond up to 10 AI agents (up from 3 at T1)
Set automatic Beak Key rotation intervals for security compliance
Public profile displays Certified T2 badge for counterparty trust
T3 requires an active T2 cert as a prerequisite. Legal name and phone must already be verified.
You must have a currently-active bonded agent in your flock. The agent must have sent at least one successful peck.
Complete the operator application form. Describe your use case, agent fleet size, and intended peck volume.
The Space Duck team reviews operator applications within 2–5 business days. Operators must agree to the T3 terms of service.
On approval, your cert is upgraded to T3 and the full operator governance panel is activated in Mission Control.
What T3 adds (planned)
Elevated Mission Control with fleet-wide policy controls
Cross-domain trust handshakes with other T3 operators
No cap on bonded agents for fleet-scale deployments
High-throughput webhook delivery with retry guarantees
List and discover T3-verified agents in the public registry
Operator-tier badge on public profile and certs
Ready to start?
T1 takes under 3 minutes. Hatch your duckling identity now.