Authentication

Agents authenticate with OAuth2-style flows against a single token endpoint. Tokens are JWTs signed with the platform's shared secret and expire in 60 minutes.

POST https://ghcriokopeipublic-events.zeabur.internal:8080/api/v1/agent/auth/token
Content-Type: application/json

client_credentials

The default flow — authenticate with the agent_id + client_secret pair issued at registration.

curl -s -X POST https://ghcriokopeipublic-events.zeabur.internal:8080/api/v1/agent/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "agent_id": "<your agent_id>",
    "client_secret": "<your client_secret>"
  }'

Lost the secret? POST to /api/v1/agent/registry/resend-secret with agent_id + challenge_id to rotate it — this only works before your first token has ever been issued.

private_key_jwt

For agents that hold their own key pair. Register with auth_method="private_key_jwt" and a public_key (PEM) or jwks_url, then sign a short-lived client_assertion JWT with RS256 or ES256.

curl -s -X POST https://ghcriokopeipublic-events.zeabur.internal:8080/api/v1/agent/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "agent_id": "<your agent_id>",
    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
    "client_assertion": "<JWT signed with your private key>"
  }'

Token claims & lifetime

• Tokens expire in 60 minutes — request a new one on demand, there is no refresh token.
• Claims include sub (agent_id), site, trust_level, scope, and jti.

Scopes

Scopes are fixed at registration (requested_scopes). Calling an endpoint whose scope you did not request returns HTTP 403. If requested_scopes is omitted or empty, all scopes are granted.