Quickstart

import { act, setActCryptoBinding } from '@openagentid/sdk';

// Once at startup: wire the crypto core (see the key-custody guide).
setActCryptoBinding(await cryptoWasmInit());

const claims = await act.verify(tokenBytes)
  .issuer('arsenal:broker:prod-1')
  .forAudience('my-service')
  .requireScope('tools:calendar:invoke')
  .trustedKeys([brokerPublicKey])
  .run();

// claims.sub is the verified agent DID. A forged, expired,
// wrong-audience, or under-scoped token throws with the reason.

from openagent_sdk import Verifier, Scope

verifier = Verifier(
    [broker_public_key],          # raw 32-byte Ed25519 keys
    "arsenal:broker:prod-1",      # expected issuer
    "my-service",                 # this service's audience
    required_scopes=[Scope.parse("tools:calendar:invoke")],
)
claims = verifier.verify(token_bytes)

verifier, err := openagent.NewVerifier(
    [][]byte{brokerPublicKey},
    "arsenal:broker:prod-1",
    "my-service",
)
claims, err := verifier.Verify(tokenBytes)

let claims = openagent_sdk::act::verify(&token_bytes)
    .issuer("arsenal:broker:prod-1")
    .for_audience("my-service")
    .require_scope(Scope::parse("tools:calendar:invoke")?)
    .trusted_keys(vec![broker_key])
    .run()?;

import { requireActExpress } from '@openagentid/sdk';

app.use('/tools', requireActExpress({
  issuer: 'arsenal:broker:prod-1',
  audience: 'my-service',
  trustedKeys: [brokerPublicKey],
}));
// Verified claims land on req.actClaims; failures 401 with the reason.

from fastapi import FastAPI
from openagent_sdk.middleware import require_act

app = FastAPI()

@app.post("/tools/calendar",
          dependencies=[require_act(verifier, scopes=["tools:calendar:invoke"])])
async def handle():
    return {"ok": True}

mux := http.NewServeMux()
mux.Handle("/tools/calendar", openagent.RequireAct(verifier, calendarScope)(handler))

import { OpenAgent, keys } from '@openagentid/sdk';

// 1. Keys first — custody is explicit (see the key-management guide).
const identity = await keys.generate();
await keys.saveSeed(identity, 'agent.seed');

// 2. Create the agent with real protocol clients.
//    @openagentid/sdk-testing exists for unit tests; production requires
//    @openagentid/oas-sdk, @openagentid/arsenal-sdk, @openagentid/aegis-sdk.
OpenAgent.configure({ clients: { identity, credentials, verification } });
const agent = await OpenAgent.createAgent({
  parent: 'did:oas:l1fe:hmr:alice',
  name: 'research-bot',
  scopes: ['openai:chat:invoke'],
});

// 3. Broker a scoped provider credential.
const handle = await agent.credentialsFor('openai');
const res = await handle.fetch(
  'https://api.openai.com/v1/chat/completions',
  { method: 'POST', body: JSON.stringify(payload) },
);

use openagent_sdk::{CreateAgentOptions, OpenAgent};

let agent = OpenAgent::create_agent(CreateAgentOptions {
    parent: None,
    name: "research-bot",
    scopes: &["openai:chat:invoke"],
    kind: None,
    derivation_path: None,
}).await?;

let creds = agent.credentials_for("openai").await?;