OpenAgent is designed to run where agent products already run: backend services, edge middleware, workers, and Rust APIs.

​
Public SDK runtimes

SDKRuntime support
TypeScriptNode 20+, Bun, Deno, browsers, Cloudflare Workers
RustRust 1.78+, Tokio services, Axum/Tower integrations

​
Deployment examples in the SDK repo

AdapterUse case
DockerSelf-hosted Node or Bun service with OpenAgent middleware
Cloudflare WorkerEdge auth and credential proxy calls near users
AWS LambdaServerless handlers that authenticate agent requests
Vercel EdgeNext.js middleware and route protection

​
Framework shape

All adapters do the same thing:
  1. run OpenAgent.authenticate(request),
  2. attach the verified context to request state,
  3. short-circuit failures with stable OpenAgent error codes,
  4. let handlers enforce route-specific scopes,
  5. call Arsenal for brokered credentials only when needed.

​
Minimal TypeScript handler

import { OpenAgent, assertScopes } from '@openagent/sdk';

export async function POST(request: Request) {
  const ctx = await OpenAgent.authenticate(request);
  assertScopes(ctx, ['tickets:triage']);

  return Response.json({ did: ctx.did, scopes: ctx.scopes });
}