Authentication protocol

For a new application, use SDK 0.7.2's receiver-issued possession proof and identity verifier. That JWT-based contract is distinct from the older OpenAgent authentication transport protocol described here.

Versioned protocol components

• openagent-auth-protocol Rust 0.1.0 supplies shared older authentication models and helpers.
• @openagentid/http 0.1.1 supplies a different challenge/session flow with documented identity-binding and concurrency limits.
• Older Rust HTTP, WebSocket, Weave and standalone implementations remain source-only; they are not current published starter integrations.

Proof workflow

Obtain a challenge from the intended server, canonicalize its exact signed representation, sign with the corresponding key, and return the proof with its nonce correlation. A correct receiving integration must verify the cryptographic proof, identity binding and freshness using its configured trust and atomic storage. The HTTP 0.1.1 limitations above mean its default successful session is not proof that all these requirements were met.

Read the authentication transport table before selecting headers. The TypeScript HTTP adapter's proactive well-known endpoints and opaque OpenAgent sessions are distinct from the standalone server's Bearer JWT handler contract.

An authenticated key is not automatically a human root, a delegated broker grant, or privileged authority. Use verification policy for those decisions. Source declarations and exact options are in the package catalog.