SDKs and compatibilityServer integration
OpenAgentIDDocumentation
Server integration
Configure identity authority, replay storage and application permission at the receiver.
A receiver owns the trust decision. Installing a package or accepting a DID string does not authorize an agent.
| Server need | Current published surface |
|---|---|
| Local application on one persistent host | OpenAgentWorkspace from SDK 0.7.2 /local |
| Shared-service identity verification | IdentityVerifier and createIdentityVerificationHandler |
| Public character/SVG rendering | createCharacterApiHandler |
| OIDC issuer for registered relying parties | @openagentid/oidc 0.2.0 |
| ACT-protected operation | Fluent verifier with an explicit receiver clock; see the middleware clock limitation |
Integration sequence
- Decide the operation and its required tenant/permission policy.
- Configure trusted identity keys, owner or self-root approval, revocation and the exact audience.
- Issue challenges through trusted server state and consume replay records atomically.
- Verify before passing identity to the application's permission check.
- Execute only after both checks succeed; retain useful denial records without credentials.
Start with current verification and production integration. Optional provider facades and older HTTP adapters have different contracts and dependencies. They are not automatically configured by the SDK.