openagentid-sdk is the tier-1 Python SDK: full façade, spec-exact ACT verification, and one-line middleware.
Private preview. Not yet on PyPI; the repository is private during consolidation. Install from git with OpenAgentID organization access.

Verify an ACT

Verification follows the normative procedure of act/SPECIFICATION.md in order — Ed25519 signature verification before any claim check, temporal checks with leeway, and issuer/audience/scope policy with the non-widening rule. Distinct errors for forgery, expiry, and misconfiguration.

Guard FastAPI routes

For whole-app coverage, require_act_starlette(verifier) is an ASGI middleware. A missing, forged, expired, wrong-audience, or under-scoped token gets a 401 with the reason (WWW-Authenticate: OpenAgent); the route never runs.

The façade

authenticate runs the Core Protocol challenge-response flow: fetch an openagent-challenge-v1, sign the JCS-canonical bytes, prove, and hold the session token. grant builds the capability request with scope grammar and TTL bounds enforced client-side.

Key custody

Everything derives deterministically from one 32-byte seed — Ed25519 signing keypair and X25519 encryption keypair, the same BLAKE3 context-separated derivation as the Rust and TypeScript SDKs (install the optional blake3 package for canonical cross-SDK derivation; HKDF-SHA256 is the fallback).

In the box

Conformance

37 pytest tests plus the 13 canonical ACT vectors via scripts/run_vectors.py — the same vectors the other five languages run.

Next