openagentid-sdk is the tier-1 Python SDK: full façade, spec-exact ACT
verification, and one-line middleware.
Private preview. Not yet on PyPI; the repository is private during
consolidation. Install from git with OpenAgentID organization access.
Verify an ACT
Verification follows the normative procedure of act/SPECIFICATION.md in
order — Ed25519 signature verification before any claim check, temporal
checks with leeway, and issuer/audience/scope policy with the non-widening
rule. Distinct errors for forgery, expiry, and misconfiguration.
Guard FastAPI routes
For whole-app coverage, require_act_starlette(verifier) is an ASGI
middleware. A missing, forged, expired, wrong-audience, or under-scoped
token gets a 401 with the reason (WWW-Authenticate: OpenAgent); the route
never runs.
The façade
authenticate runs the Core Protocol challenge-response flow: fetch an
openagent-challenge-v1, sign the JCS-canonical bytes, prove, and hold the
session token. grant builds the capability request with scope grammar and
TTL bounds enforced client-side.
Key custody
Everything derives deterministically from one 32-byte seed — Ed25519
signing keypair and X25519 encryption keypair, the same BLAKE3
context-separated derivation as the Rust and TypeScript SDKs (install the
optional blake3 package for canonical cross-SDK derivation; HKDF-SHA256
is the fallback).
In the box
37 pytest tests plus the 13 canonical ACT vectors via
scripts/run_vectors.py — the same vectors the other five languages run.
Next