agent-authCredentials for AI agents that you can scope, expire, revoke and audit

A small self-hosted service, CLI and TypeScript SDK. Give an agent exactly the authority a task needs, and see everything it did with it.

Narrow scopes

Scopes name actions, resources, parameters and spend limits, such as gmail:send to:*@acme.com or payments:charge max=50USD.

An agent can hand a sub-agent a narrower token. The service proves the child is no broader than its parent.

Revoking a token cuts off everything derived from it. Tokens also expire and can carry use limits.

Mark risky scopes approval=required, and each use waits for a person to approve that exact request.

Every decision lands in a hash-chained log. agent-auth audit verify finds the first altered entry.

Standalone executables, a multi-arch container image and an npm package, each with provenance attestations.