auth51-verifier

Resource-server (RS) enforcement library for auth51 Agentic JWT intent tokens. Mount it on your API and it authorizes each request offline — "protect the resource, not the host."

It verifies, in one pass and without calling back to the Authority:

• signature against the Authority's published JWKS (fetched + cached),
• issuer / expiry / audience / scopes,
• Proof-of-Possession (DPoP cnf.jkt, with legacy RSA cnf.jwk fallback) — a stolen bearer token is useless without the sender's key,
• value binding — the token's frozen vb claim is re-checked against the real request (static invariants, the action_hash, and T2 reference bounds resolved at the resource through registered providers), using the same auth51-governance evaluator the Authority used at mint.

Install

pip install auth51-verifier

auth51-governance (the value-binding evaluator) is pulled in automatically.

Use

from fastapi import Depends, FastAPI
from auth51_verifier import install_signature_middleware, require_auth

app = FastAPI()
install_signature_middleware(app)

@app.get("/data", dependencies=[Depends(require_auth("read:data", audience="api.example.com"))])
def read_data():
    return {"ok": True}

Configure it from the environment (no code wiring):

AUTHORITY_URL=https://authority.auth51.com
JWKS_PATH=/v1/oauth/.well-known/jwks.json
EXPECTED_ISS=https://authority.auth51.com
REQUIRE_POP=true
ENFORCE_VALUE_BINDING=true

Value-binding reference providers (T2)

A reference bound such as refund.amount <= charge.amount freezes an unresolved reference in the token; the resource resolves it against its own system of record at request time. Register a provider so the verifier can look it up:

from auth51_verifier.extraction import register_provider

# args are pulled from the real request; return the record the bound reads its field from
register_provider("charge_lookup", lambda args: load_charge(args["charge_id"]))

If no provider is registered for a reference bound, the request fails closed — the verifier never assumes a bound it cannot check.

License

Apache-2.0