Credential handles
Request, use, refresh, and release broker-backed credentials explicitly.
TypeScript agent.credentialsFor(provider) uses the configured ArsenalClient to request an IssuedCredential and returns a CredentialHandle. The provider, agent identity, scopes, broker policy, and tenant trust must already be configured.
Handle lifecycle
| API | Behavior |
|---|---|
provider, agentDid, expiresAt | Read-only metadata for the issued handle |
fetch(input, init) | Route the intended target through the issued proxy URL using X-Arsenal-Target |
refresh() | Request a fresh credential and return a new handle |
release() | Mark the handle released and invoke the optional broker release callback |
Refresh is explicit in this implementation. The per-request path does not silently mint a new token on expiry. Keep and use the handle returned by refresh(). A released handle rejects use; errors from minting, proxying, or releasing must be handled.
Broker boundary
ArsenalClient.requestCredential accepts agentDid, provider, and optional scopes. It returns the proxy URL, expiration and optional remaining-call metadata. A TypeScript adapter must map that interface to the actual broker contract; method-shape compatibility alone does not establish secure deployment.
Keep issuer credentials in the configured custody/broker system. Do not accept an arbitrary proxy URL or target from an untrusted agent without the intended broker policy and destination validation.
The SDK 0.7.2 credential declarations define this facade contract. See Arsenal broker routes and ACTs.