agent-id-service-sdk 0.4.0

AgentID — Service-side SDK for verifying AI agent JWTs and reporting activity

agent-id-service-sdk

AgentID Service SDK — for services and APIs to verify AI agent JWTs and report activity back to the IdP.

Installation

pip install agent-id-service-sdk

Quick Start

from agent_id_service_sdk import AIPVerifier

verifier = AIPVerifier(
    trusted_providers=["qwenpaw.ai"],
    audience="https://my-service.example.com",
)

# HTTP (REST)
agent = await verifier.verify(request.headers["Authorization"])

# WebSocket / gRPC / MCP — use verify_token() with the raw JWT
agent = await verifier.verify_token(raw_jwt_string)

print(f"Agent: {agent.agent_id}, Principal: {agent.principal}")

Features

• Transport-agnostic — verify() for HTTP headers, verify_token() for raw JWTs (WebSocket, gRPC, MCP)
• Multi-algorithm support — Verifies JWTs signed with ES256 (ECDSA P-256) or EdDSA (Ed25519)
• Key rotation resilience — Automatically refetches JWKS when an unknown kid is encountered
• Clock skew tolerance — Configurable leeway (default 30s) for JWT expiry checks
• JWKS caching — Caches provider public keys with configurable TTL (default 1 hour)
• Activity reporting — Built-in AIPActivityReporter for sending activity logs back to the IdP

Configuration

verifier = AIPVerifier(
    trusted_providers=["qwenpaw.ai", "other-idp.example.com"],
    audience="https://my-service.example.com",
    cache_ttl=3600,            # JWKS cache TTL in seconds (default: 1 hour)
    clock_skew_seconds=30,     # Clock skew tolerance (default: 30s)
    provider_urls={            # Optional: override base URLs (e.g. for local dev)
        "localhost": "http://localhost:8000",
    },
)

Documentation

See the AgentID repository for full documentation.