Arsenal credentials
Scoped capabilities, credential storage, policy, and brokered requests.
Arsenal separates an agent's authority to invoke a provider from custody of the provider's secret. Its six Rust packages provide core types, cryptography, policy evaluation, storage, broker service and SDK. The Rust crates publish at 2.0.0. A separate @openagentid/arsenal-sdk@0.1.1 npm package has its own exported API.
Credential workflow
- Establish the agent and tenant using configured identity and trust.
- Request the minimum capability/credential scope required by the operation.
- Evaluate tenant policy and consent requirements.
- Issue the appropriate bounded token or credential response.
- Use the broker proxy with destination policy and transport security.
- Refresh, release or revoke according to the concrete client contract.
The TypeScript credentialsFor facade returns a proxy-oriented handle. That facade is distinct from the broker's full API, which also has wrapped-secret delivery. Do not make a blanket claim that every Arsenal mode can never deliver credential material.
Read ACT format, broker routes, policy, consent, and audit. The package catalog maps all six Rust packages and the TypeScript surface to their published versions.