Verifiable Authorization for AI Agents

What is AgentOAuth?

AgentOAuth is a neutral protocol for AI agents to prove who authorized what. It provides verifiable authorization tokens with clear scope, limits, and expiration—built on OAuth/JWT patterns for maximum interoperability.

Unlike traditional OAuth which only proves "access was granted," AgentOAuth creates a cryptographic audit trail proving both the agent's intent and the verifier's approval.

The Two-Layer Signature System

Every AgentOAuth transaction has two independent, verifiable signatures:

What is a Consent Token?

A Consent Token is a signed JWT containing the agent's authorization policy. It specifies exactly what the agent can do, with verifiable limits and constraints.

{
  "ver": "act.v0.2",
  "user": "did:user:alice",
  "agent": "did:agent:travel-assistant",
  "scope": "payments.send",
  "policy": {
    "version": "pol.v0.2",
    "id": "pol_abc123",
    "actions": ["payments.send"],
    "resources": [
      {"type": "merchant", "match": {"ids": ["airbnb", "expedia"]}}
    ],
    "limits": {
      "per_txn": {"amount": 500, "currency": "USD"},
      "per_period": {"amount": 1500, "currency": "USD", "period": "week"}
    },
    "constraints": {
      "time": {"start": "08:00", "end": "20:00", "tz": "UTC"}
    }
  },
  "policy_hash": "sha256:3fd9...",
  "exp": 1762140000,
  "jti": "act_unique_id"
}

Quick Start: Verify a Token

No signup required! Start verifying tokens immediately:

# No API key needed!
curl -X POST https://verifier.agentoauth.org/verify \
  -H "Content-Type: application/json" \
  -d '{
    "token": "eyJhbGciOiJFZERTQSI...",
    "audience": "merchant.example"
  }'

{
  "valid": true,
  "payload": {
    "user": "did:user:alice",
    "agent": "did:agent:travel-ai",
    "scope": "payments.send",
    "policy": {...}
  },
  "policy_decision": {
    "allowed": true,
    "receipt_id": "receipt_abc123",
    "remaining": {
      "period": 1100,
      "currency": "USD"
    }
  }
}

import { verify } from '@agentoauth/sdk';

const result = await verify(
  token,
  'https://verifier.agentoauth.org/.well-known/jwks.json',
  { audience: 'merchant.example' }
);

if (result.valid) {
  console.log('✅ Token verified!');
  console.log('User:', result.payload.user);
  console.log('Policy:', result.payload.policy);
} else {
  console.error('❌ Verification failed:', result.error);
}

npm install @agentoauth/sdk

Creating Tokens

To create AgentOAuth tokens with policies:

Using the SDK (Recommended)

import { issueConsent, buildPolicyV2 } from '@agentoauth/sdk';
import { generateKeyPair, exportJWK } from 'jose';

// 1. Create policy
const policy = buildPolicyV2()
  .id('pol_travel_001')
  .actions(['payments.send'])
  .merchants(['airbnb', 'expedia'])
  .limitPerTxn(500, 'USD')
  .limitPerPeriod(1500, 'USD', 'week')
  .timeConstraints({ start: '08:00', end: '20:00', tz: 'UTC' })
  .finalize();

// 2. Generate signing keys
const { privateKey } = await generateKeyPair('EdDSA');
const privateJWK = await exportJWK(privateKey);

// 3. Issue token
const { token } = await issueConsent({
  user: 'did:user:alice',
  agent: 'did:agent:travel-ai',
  scope: 'payments.send',
  policy: policy,
  privateKey: privateJWK,
  keyId: 'key-001',
  expiresIn: '7d'
});

console.log('Token created:', token);

Playground Demo Tokens

Want to test the full flow without setting up the SDK? The AgentOAuth Playground now supports demo token issuance for educational purposes!

Demo Token API

You can also issue demo tokens programmatically:

# Issue a demo token (100/hour rate limit per IP)
curl -X POST https://verifier.agentoauth.org/playground/issue-demo-token \
  -H "Content-Type: application/json" \
  -d '{
    "policy": {
      "version": "pol.v0.2",
      "id": "pol_demo_001",
      "actions": ["payments.send"],
      "resources": [],
      "limits": {
        "per_txn": { "amount": 500, "currency": "USD" }
      }
    },
    "user_id": "demo-user",
    "agent_id": "demo-agent",
    "expires_in": 3600
  }'

Demo Issuer JWKS

Demo tokens are signed with a dedicated demo issuer key. Public key available at:

https://verifier.agentoauth.org/playground/.well-known/jwks.json

Free Tier Limits

The hosted verifier is free to use with generous limits:

No API key required! Rate limits are enforced by token issuer (iss claim) and IP address. Perfect for testing, prototypes, and low-volume production use.

Need higher limits? Contact us for custom API keys with increased quotas.

API Endpoints

Full API documentation: SPEC.md

Resources