@openagentid/sdk/credentials

All packages · Runnable examples · Start an agent

Contract	Value
Package	@openagentid/sdk@0.7.2
Entry point	@openagentid/sdk/credentials
Availability	Current integration path
Reference source	Published TypeScript declarations
Package engines	node >=20

Before integrating

The published VERSION constant is still the literal "0.6.0" in the 0.7.2 archive. Use package metadata or your lockfile to identify the installed release; do not use VERSION as a release check.

When using @openagentid/crypto-wasm 0.1.1 for ACT verification, call the SDK verifier builder .atTime(Math.floor(Date.now() / 1000)) on every verification. The default WASM system-clock path traps in Node. Supply trusted receiver current epoch seconds; never token-supplied time or a timestamp captured once at startup. The complete ACT example covers this requirement.

In SDK 0.7.2, withAct and requireActExpress do not expose a verification-clock option. The raw crypto-wasm 0.1.1 binding alone therefore traps for these wrappers; use the tested fluent .atTime(...) example, or qualify a binding adapter that supplies fresh trusted receiver time on every verification.

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Condition	Published file
types	`./dist/credentials.d.ts`
import	`./dist/credentials.js`
require	`./dist/credentials.cjs`

ArsenalClient

Arsenal broker client facade. The real client lives in @openagentid/arsenal-sdk and is injected by the application; see INTEGRATION_NOTES.md.

Type-only declaration; it is not a runtime value.

Signature

interface ArsenalClient {
    requestCredential(params: {
        agentDid: Did;
        provider: string;
        scopes?: readonly string[];
    }): Promise<IssuedCredential>;
    release?(credentialProxyUrl: string): Promise<void>;
}

Source: @openagentid/sdk@0.7.2, dist/credentials.d.ts:51.

createCredentialHandle

Create a {@link CredentialHandle} backed by an Arsenal client.

Signature

declare function createCredentialHandle(params: CreateCredentialHandleParams): Promise<CredentialHandle>;

Source: @openagentid/sdk@0.7.2, dist/credentials.d.ts:96.

CreateCredentialHandleParams

Arguments for constructing a credential handle.

Type-only declaration; it is not a runtime value.

Signature

interface CreateCredentialHandleParams {
    agentDid: Did;
    provider: string;
    arsenal: ArsenalClient;
    fetchImpl: typeof fetch;
    requestTimeoutMs: number;
    scopes?: readonly string[];
}

Source: @openagentid/sdk@0.7.2, dist/credentials.d.ts:87.

CredentialHandle

A live, fetch-ready credential bound to an agent DID + provider.

The fetch method is a drop-in replacement for globalThis.fetch. The underlying credential is refreshed lazily when the caller invokes refresh() — auto-rotation stays out of the per-request hot path.

Type-only declaration; it is not a runtime value.

Signature

interface CredentialHandle {
    readonly provider: string;
    readonly agentDid: Did;
    readonly expiresAt: number;
    fetch: typeof fetch;
    refresh(): Promise<CredentialHandle>;
    release(): Promise<void>;
}

Source: @openagentid/sdk@0.7.2, dist/credentials.d.ts:68.

IssuedCredential

A short-lived credential minted by the Arsenal broker.

Type-only declaration; it is not a runtime value.

Signature

interface IssuedCredential {
    provider: string;
    proxyUrl: string;
    expiresAt: number;
    remainingCalls?: number;
    metadata?: Record<string, unknown>;
}

Source: @openagentid/sdk@0.7.2, dist/credentials.d.ts:32.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

Did

Fully qualified did:oas identifier.

Type-only declaration; it is not a runtime value.

Signature

type Did = string;

Source: @openagentid/sdk@0.7.2, dist/identity.d.ts:7.

Package requirements

Dependencies

Package	Published range
zod	`^3.23.8`
jose	`^5.10.0`
@noble/hashes	`^1.8.0`
@scure/base	`^1.2.6`

Peer dependencies

Package	Published range	Optional
@openagentid/aegis-sdk	`^0.1.0`	Yes
@openagentid/arsenal-sdk	`^0.1.0`	Yes
@openagentid/crypto-wasm	`^0.1.0`	Yes
@openagentid/oas-sdk	`^1.0.2`	Yes

Archive verification

Pinned integrity:

SHA-512 integrity

sha512-9YlDb02di8sGffhuMOwNAQa/M3oBrhaqPc7t+qBltdoQRCqlxDmYB/nTRSB4eZgwE4lvM4TKzI72nJtJSVm/ww==

Machine-readable API manifest · Coverage

On this page