Authentication protocol
Canonical challenge proofs with transport-specific discovery and sessions.
Authentication proves possession of the signing key associated with a request. The protocol models challenge, proof, session state and errors; transport adapters decide how those messages are carried.
Implemented source surfaces
openagent-auth-protocol: shared Rust authentication models and helpers.- HTTP TypeScript/Rust adapters: concrete transport implementation.
- WebSocket Rust and Weave adapters: separate source packages with their own interfaces.
- Legacy Rust server: middleware and JWT sessions used by the standalone binary.
Proof workflow
Obtain a challenge from the intended server, canonicalize its exact signed representation, sign with the corresponding key, and return the proof with its nonce correlation. The server verifies the cryptographic proof and freshness using its configured trust and storage. Replayed or invalid proofs must be denied.
Read the authentication transport table before selecting headers. The TypeScript HTTP adapter's proactive well-known endpoints and opaque OpenAgent sessions are distinct from the standalone server's Bearer JWT handler contract.
An authenticated key is not automatically a human root, a delegated broker grant, or privileged authority. Use verification policy for those decisions. Source declarations and exact options are in the package catalog.