Client proof flow
Use the current receiver-issued challenge, signed proof and verification contract.
The working starter implements the complete current flow with SDK 0.7.2:
- The receiver explicitly approves the public identity.
- The receiver issues a fresh challenge for that identity and its audience.
- The signer creates a possession proof with its private key.
- The receiver checks the proof, current trust and revocation, and consumes replay state.
- The application decides whether the authenticated identity may perform the requested action.
OpenAgentWorkspace.issueChallenge, prove and verify are the concrete local APIs. The local identity guide has complete programs for provisioning, reopening and revoking the same identity. Shared services use IdentityVerifier with their own authoritative adapters.
Existing HTTP adapter clients
HttpAuthClient from @openagentid/http@0.1.1 uses a separate discovery/challenge/session flow. Its constructor receives config, sign, publicKey and optional transport. The signing and public-key callbacks must use the same keypair; signatures cover canonicalChallengeBytes rather than a current SDK JWT.
The older adapter does not bind its default session result to the claimed agent DID and has other documented limits. Preserve the protocol only when maintaining a matching existing deployment. Published client declarations.