Server handlers

SDK 0.7.2 exposes createIdentityVerificationHandler from @openagentid/sdk/verification-api. Your application chooses the POST route and provides a configured IdentityVerifier, expected audience and a resolveNonce callback that validates a receiver-issued challenge.

Follow the verification guide for the typed integration function. Resolving a nonce must not mean echoing a caller's untrusted value. Required key purposes, current root approval, revocation and atomic replay consumption belong to the verifier's configured authority.

Separate handlers

• createCharacterApiHandler serves public stateless rendering data. It supplies no authentication or authorization.
• ACT capability verification uses the real crypto binding with trusted keys, expected issuer/audience, route-required scopes and a fresh receiver clock. Run the complete fluent-verifier example.
• @openagentid/oidc hosts the OIDC protocol under your configured issuer, storage and consent integration.

ACT middleware clock limitation

SDK 0.7.2 exports withAct and requireActExpress, but both call the ACT builder without setting its verification time. Their RequireActConfig has no clock option. With setActCryptoBinding({ act_verify }) wired directly to @openagentid/crypto-wasm@0.1.1, an otherwise valid token reaches that binding's unsupported default WASM system-clock path and verification fails. Installing the compiled binding alone does not make these middleware wrappers work.

Use the tested fluent .atTime(Math.floor(Date.now() / 1000)) path and enforce its result at your application's request boundary. To use those middleware wrappers with this binding version, the host must supply and qualify a binding adapter that forwards a fresh, trusted receiver time to the raw act_verify function on every call. The configuration's leewaySeconds is clock-skew allowance, not a clock replacement. No tested middleware adapter recipe is provided here; the complete example exercises the fluent verifier.

Keep time independent of incoming claims and read it for each verification. Preserve signature, issuer, audience, scope, expiry and not-before checks, and deny the operation on any failure. The published middleware declarations describe the available configuration fields.

Older HTTP middleware

@openagentid/http@0.1.1 is a separate handshake/session adapter. Its Fetch handler returns either a Response or AuthResult; inspect authenticated before continuing. Its Express wrapper drops the request body in the published implementation, and its proof store does not atomically consume concurrent challenges. It is not the recommended middleware for a new current-identity integration. Exact limits.

There is no @openagentid/sdk/server or @openagentid/sdk/server/hono export. Use published export paths and your framework's actual Request/Response bridge.