Sessions
State, expiry, token schemes, and storage differ by authentication adapter.
A session records successful authentication for a bounded period. Use the session contract belonging to the actual server implementation; sessions are not a universal token format across OpenAgentID libraries.
Standalone Rust server
The legacy standalone server issues signed JWT sessions and its /v1/whoami handler accepts Authorization: Bearer <session>. Session validation uses the server's configured signing secret and time policy. The default session TTL is 900 seconds in that binary.
TypeScript HTTP adapter
The HTTP adapter creates opaque random session strings and resolves them through a SessionStore. These are not JWTs and are not derived from an ECDH shared secret. Authorization: OpenAgent <session> carries this adapter's session. Its default TTL is 300 seconds.
InMemorySessionStore is process-local. A serverless or replicated service needs consistent shared state, expiration, and replay behavior. Restarting a process loses its in-memory sessions.
Session handling
- Use the deployment's discovery/handshake contract.
- Keep the returned session private and transmit it over TLS.
- Preserve the expected header scheme and issuer/server binding.
- Handle expiry by performing the implementation's supported reauthentication flow.
- Apply action-level scopes, tenant checks, and authority policy after authentication.
Do not exchange a session for an ACT by renaming its header. ACTs are signed capability envelopes and carry a different verification/authorization contract.
Source: openagents/openagent.id/crates/openagent-server/src/session.rs, openagent-sdk/adapters/http/typescript/src/server.ts, session.ts, and headers.ts.