Go SDK

The source module is github.com/OpenAgentID/openagent-sdk-go, requiring Go 1.26.4 in its current go.mod. Import the openagent subpackage. For a local source integration, use a replace directive in your application's module:

replace github.com/OpenAgentID/openagent-sdk-go => ../openagent-sdk/sdks/go

Resolve dependencies from your application using its chosen versioning policy. The local replacement is a source-development mechanism, not proof of a remotely published tag.

Verify with a required scope

package verification

import "github.com/OpenAgentID/openagent-sdk-go/openagent"

func VerifyCalendar(token, publicKey []byte, issuer, audience string) (*openagent.ActClaims, error) {
    verifier, err := openagent.NewVerifier([][]byte{publicKey}, issuer, audience)
    if err != nil {
        return nil, err
    }
    scope, err := openagent.ParseScope("tools:calendar:invoke")
    if err != nil {
        return nil, err
    }
    return verifier.RequiringScopes(scope).Verify(token)
}

The token is binary CBOR and the trusted public key is raw 32-byte Ed25519. Propagate every verification error as denial. DecodeUnverified is an inspection helper; use Verify for authorization.

HTTP integration

RequireAct(verifier, scopes...) wraps an http.Handler. RequireActFunc wraps an http.HandlerFunc. ClaimsFromRequest reads verified claims after the middleware succeeds. Configure issuer/audience/scopes at the route boundary and keep your trusted key set outside user input.

Key custody

Current Go custody uses BLAKE2b, so do not assume matching encryption keys when importing a seed from another language. See key management.

Source: openagent-sdk/sdks/go/go.mod, openagent/act.go, scope.go, middleware.go, and keys.go.