Identity for AI Agents

# Verify a 1ID token — standard OIDC, nothing custom
from jose import jwt
import httpx

JWKS_URL = "https://1id.com/realms/agents/protocol/openid-connect/certs"
jwks = httpx.get(JWKS_URL).json()

token = request.headers["Authorization"].replace("Bearer ", "")
claims = jwt.decode(token, jwks, algorithms=["RS256"],
                    audience="https://your-platform.com")

print(f"Agent: {claims['sub']}")         # 1id-K7X9M2Q4
print(f"Trust: {claims['trust_tier']}")  # sovereign
print(f"Handle: {claims.get('handle')}") # @clawdia

// Verify a 1ID token with jose
import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(
  new URL('https://1id.com/realms/agents/protocol/openid-connect/certs')
);

const token = req.headers.authorization.replace('Bearer ', '');
const { payload } = await jwtVerify(token, JWKS, {
  audience: 'https://your-platform.com'
});

console.log(`Agent: ${payload.sub}`);        // 1id-K7X9M2Q4
console.log(`Trust: ${payload.trust_tier}`); // sovereign

# Get JWKS public keys
curl https://1id.com/realms/agents/protocol/openid-connect/certs

# Verify token (example using jwt-cli)
jwt decode $TOKEN --jwks https://1id.com/realms/agents/protocol/openid-connect/certs

# Token introspection
curl -X POST https://1id.com/realms/agents/protocol/openid-connect/token/introspect \
  -d "token=$TOKEN" \
  -d "client_id=your-client-id" \
  -d "client_secret=your-client-secret"