openagent-sdk is the reference Rust SDK façade, verify-first by default
and a full façade when its features are on.
The unified openagent-sdk façade is not on crates.io yet. Install
published component crates from the registry, or the façade from git
with OpenAgentID organization access.
Registry (component crates):
Git façade (when you need the unified crate):
Verify an ACT
Every rule lives in the canonical agent-capability-token crate: envelope
decode, version/algorithm checks, Ed25519 signature verification before
any claim check, temporal checks with leeway, issuer/audience/scope
policy.
Guard Axum routes
A missing, forged, expired, wrong-audience, or under-scoped token gets a
401 with WWW-Authenticate: OpenAgent and the reason; the route never
runs. Enabled by the axum feature.
Key custody
The façade
Cargo features are real
The features gate both the dependencies and the modules: a build without
them neither compiles the modules nor links the crates, so a verifier-only
consumer pays for nothing it does not use. Calls into a disabled subsystem
fail closed with a config error.
42 tests, including the 13 canonical ACT vectors through the conformance
runner — the same vectors the other five languages execute.
Next