authgent-server

The open-source OAuth 2.1 Authorization Server for AI agents — MCP-native, delegation-aware, with DPoP sender-constrained tokens and human-in-the-loop step-up authorization.

Install

pip install authgent-server

# With PostgreSQL support
pip install authgent-server[postgres]

Quick Start

# Start the server (auto-initializes on first run)
authgent-server run

Server starts at http://localhost:8000:

• GET /.well-known/oauth-authorization-server — server metadata
• GET /.well-known/jwks.json — public signing keys
• GET /docs — interactive Swagger UI

CLI Commands

authgent-server run             # Start server (auto-initializes on first run)
authgent-server init            # Explicitly init (custom DB URL, force-regenerate)
authgent-server create-agent    # Register an agent interactively
authgent-server migrate         # Run Alembic migrations
authgent-server migrate --dry-run  # Preview pending migrations

API Endpoints

OAuth 2.1 Core

Device Authorization (RFC 8628)

Step-Up Authorization (HITL)

Agent Identity Registry

Discovery & Health

Configuration

All settings via AUTHGENT_* environment variables. See .env.example for the full list.

Essential

Token Lifetimes

Policy

Pluggable Providers

Deployment

Docker

docker compose up -d

The included docker-compose.yml runs the server with PostgreSQL.

Docker (standalone)

docker build -t authgent-server .
docker run -p 8000:8000 \
  -e AUTHGENT_SECRET_KEY=your-secret-key \
  -e AUTHGENT_DATABASE_URL=sqlite+aiosqlite:///./authgent.db \
  authgent-server

Production Checklist

• Set a strong AUTHGENT_SECRET_KEY (64+ characters)
• Use PostgreSQL (AUTHGENT_DATABASE_URL=postgresql+asyncpg://...)
• Run migrations: authgent-server migrate
• Set AUTHGENT_REGISTRATION_POLICY=token or admin
• Set AUTHGENT_CONSENT_MODE=ui for human-facing flows
• Enable DPoP: AUTHGENT_REQUIRE_DPOP=true
• Configure CORS origins: AUTHGENT_CORS_ORIGINS=["https://your-app.com"]
• Put behind a reverse proxy (nginx/Caddy) with TLS
• Set up log aggregation (structured JSON output)

Architecture

Endpoints → Services → Models → DB
  (thin)    (stateless)  (ORM)   (async)

• Endpoints — FastAPI routers, HTTP validation, dependency injection
• Services — All business logic, receive db: AsyncSession per call
• Models — SQLAlchemy 2.0 async ORM, 9 tables
• Providers — 7 pluggable Python Protocol interfaces (attestation, policy, HITL, keys, events, claim enricher, human auth)

See ARCHITECTURE.md for the full implementation design.

Development

# Setup
git clone https://github.com/authgent/authgent.git
cd authgent/server
pip install -e ".[dev,migrations]"
authgent-server init

# Test (192 tests)
pytest -v

# Lint + format
ruff check . && ruff format --check .

# Type check
mypy authgent_server/ --ignore-missing-imports

# Coverage
coverage run -m pytest tests/ && coverage report

License

Apache 2.0