HTTP adapter 0.1.1
Published handshake and session contracts, with the limits of this older adapter.
@openagentid/http@0.1.1 is published separately from SDK 0.7.2. Use current identity verification for a new identity integration. This page documents the older adapter for existing consumers; its sessions are not interchangeable with {token, delegations} proofs or OIDC tokens.
Published routes
| Method | Path | Result |
|---|---|---|
| GET | /.well-known/openagent | Discovery fields auth_endpoint, supported_versions, server_did, required_conformance_level |
| POST | /.well-known/openagent/auth | Challenge type, nonce, timestamp, origin, optional realm |
| POST | /.well-known/openagent/auth/prove | IdentityVerified session response |
IdentityProof carries a base64url signature, base64url raw public_key, key_type and the issued nonce. The client signs canonicalChallengeBytes(challenge) and the server verifies those exact bytes. Although the input type admits secp256k1, the published server rejects every key type except ed25519 before calling the supplied verifier.
Handler contract
handleDiscovery(config)returns discovery.handleChallenge(config, store)creates a pending challenge.handleProve(config, store, body, verifySignature)checks the pending challenge and signature, then stores an opaque session.authenticateRequest(request, store)resolves a presented session.createOpenAgentHandler(options).handle(request)returns aResponseor anAuthResult. Checkauthenticatedbefore executing a protected action.
The default session lifetime is 300 seconds; the challenge lifetime is 60 seconds. Authorization: OpenAgent <session> carries an opaque session, not a JWT. Never print or publish the actual session token.
Version 0.1.1 integration limits
The published implementation leaves initiatorDid empty when creating a challenge and returns that value in the verified session. A successful key proof therefore does not establish the caller's claimed agent DID, ownership or lineage. Setting a trust-tier label is not an authority check.
Pending challenges use separate asynchronous get and remove calls. Sequential reuse is refused, but this interface does not provide atomic consumption against concurrent proofs. An in-memory store also loses state on restart. A shared store alone does not prove that the whole proof transaction is serialized.
The Express-style createOpenAgentMiddleware wrapper reconstructs a Fetch Request without the incoming body. Its published wrapper therefore cannot carry the JSON proof through to request.json(). Do not use it as a complete Express authentication recipe.
The package also declares an optional @openagentid/auth-protocol@^0.1.0 peer, but that npm package is not published. The separately published Rust crate is not a replacement npm dependency. Do not add an install command for that missing peer. These limits are reasons to use the current local workspace or configured verifier for new applications.
Exact published declarations include the signatures, schemas, error types and client/session classes.