Authentication and protocol boundaries
Start with current possession proofs or OIDC; preserve each older transport's exact contract.
The current public starter authenticates real requests using SDK 0.7.2's receiver-issued challenge and signed possession proof. Local identity provides the complete implementation. Portable verification describes authoritative shared-service integration; OIDC signs agents into relying parties registered with your issuer.
| Surface | Representation | Current guide |
|---|---|---|
| Local workspace / IdentityVerifier | {token, delegations}; possession JWT binds exact audience, issued nonce and key purpose | Identity verification |
| Agent OIDC provider 0.2.0 | Authorization code + S256 PKCE, signed ID token and UserInfo | OIDC |
| ACT authorization | Signed CBOR capability checked against trusted issuer, audience, time and required scopes | ACT |
Authentication establishes the accepted identity under current authority. The receiving application separately enforces operation permissions and tenant access. Do not use decoded claims, an avatar or a caller-proposed key as authorization.
Older transport contracts
@openagentid/http@0.1.1 uses opaque stored sessions through Authorization: OpenAgent <session>, with discovery/challenge/proof endpoints. Its default implementation does not bind the result to the claimed agent DID and does not atomically consume concurrent proofs. See the exact published contract and limits; it is not the recommended path for new identity integrations.
The older standalone Rust server is not published on crates.io. Its JWT sessions and signature headers are separate from current SDK proofs; use the migration guide to choose a current contract. The retired source snapshot is no longer presented as a runnable server installation.
Those angle-bracket strings are transport notation, not usable tokens. Always use the signing representation, trust and storage required by the selected protocol.