openagent-sdk is the reference Rust SDK façade, verify-first by default and a full façade when its features are on.
The unified openagent-sdk façade is not on crates.io yet. Install published component crates from the registry, or the façade from git with OpenAgentID organization access.
Registry (component crates):
Git façade (when you need the unified crate):

Verify an ACT

Every rule lives in the canonical agent-capability-token crate: envelope decode, version/algorithm checks, Ed25519 signature verification before any claim check, temporal checks with leeway, issuer/audience/scope policy.

Guard Axum routes

A missing, forged, expired, wrong-audience, or under-scoped token gets a 401 with WWW-Authenticate: OpenAgent and the reason; the route never runs. Enabled by the axum feature.

Key custody

The façade

Cargo features are real

The features gate both the dependencies and the modules: a build without them neither compiles the modules nor links the crates, so a verifier-only consumer pays for nothing it does not use. Calls into a disabled subsystem fail closed with a config error.

Conformance

42 tests, including the 13 canonical ACT vectors through the conformance runner — the same vectors the other five languages execute.

Next