Go SDK

openagent-sdk-go is the Go SDK, verify-first like the other languages: most services never mint an ACT — they verify one.

Private preview. The module path resolves from the private repository with OpenAgentID organization access.

go get github.com/OpenAgentID/openagent-sdk-go

Verify an ACT

verifier, err := openagent.NewVerifier(
    [][]byte{brokerPublicKey},      // raw 32-byte Ed25519 keys
    "arsenal:broker:prod-1",        // expected issuer
    "my-service",                   // this service's audience
)
claims, err := verifier.Verify(tokenBytes)

Or the fluent shape, mirroring the other SDKs:

claims, err := openagent.Verify(tokenBytes).
    Issuer("arsenal:broker:prod-1").
    ForAudience("my-service").
    RequireScope(scope).
    TrustedKeys(brokerPublicKey).
    Run()

Verification follows the normative order: envelope decode, version and algorithm checks, Ed25519 signature verification (stdlib) before any claim check, temporal checks with leeway, and issuer/audience/scope policy. The aud field accepts a string or an array per the spec. Sentinel error kinds are errors.Is-distinguishable — forgery, expiry, and misconfiguration report differently.

Guard handlers

mux := http.NewServeMux()
mux.Handle("/tools/calendar", openagent.RequireAct(verifier, calendarScope)(handler))

A missing, forged, expired, wrong-audience, or under-scoped token gets a 401 with the reason and WWW-Authenticate: OpenAgent; the route never runs. Verified claims are available via openagent.ClaimsFromRequest(r).

Key custody

keys, _ := openagent.GenerateKeys()
_ = openagent.SaveSeed(keys, "agent.seed")      // owner-only (0600)
keys, _ = openagent.KeysFromSeedFile("agent.seed")
// or: openagent.KeysFromEnv("AGENT_SEED_HEX")

Everything derives deterministically from one 32-byte seed (Ed25519 signing keypair + X25519 encryption keypair). Go custody uses BLAKE2b keyed derivation (documented); the canonical cross-SDK derivation is BLAKE3 — Go custody is self-consistent.

In the box

Area	What it does
`Verifier` / `Verify()`	Canonical ACT verification + fluent builder
`RequireAct` / `RequireActFunc`	net/http middleware
Keys	Seed-based custody, env/file restore
`Scope`	Three-segment grammar + non-widening

Conformance

12 Go tests plus the 13 canonical ACT vectors via cmd/run-vectors — the same vectors the other five languages run.

Getting Started

Feature Stack

OpenAgent SDK

OpenAgent Client

OpenAgent Server

Verify an ACT

Guard handlers

Key custody

In the box

Conformance

Next

​Verify an ACT

​Guard handlers

​Key custody

​In the box

​Conformance

​Next

Verify an ACT

Guard handlers

Key custody

In the box

Conformance

Next