demarche (Python)

Vendor-neutral identity verification for AI agents.

Demarche sits between your application and agent-identity issuers (Microsoft Entra Agent ID, Auth0 for AI Agents, any OAuth OBO issuer). Integrate once, verify agents from any issuer.

Install

pip install demarche                    # core + OAuth OBO + Entra/Auth0
pip install 'demarche[fastapi]'         # + FastAPI integration

Quickstart

from demarche import Verifier, entra_agent_id

verifier = Verifier(adapters=[
    entra_agent_id(
        tenant_id="<your-azure-tenant-id>",
        audience="api://your-app",
    ),
])

result = await verifier.verify(token)
result.principal_id  # the user who delegated authority
result.agent_id      # the agent acting on the user's behalf
result.scopes        # what the agent is authorized to do
result.audit_id      # opaque ID for log correlation

For Auth0:

from demarche import Verifier, auth0_ai_agents

verifier = Verifier(adapters=[
    auth0_ai_agents(
        domain="myapp.us.auth0.com",
        audience="https://api.myapp.com",
    ),
])

For any other OAuth OBO issuer:

from demarche import Verifier, OAuthOBOAdapter, JWKSKeyProvider

verifier = Verifier(adapters=[
    OAuthOBOAdapter(
        issuer="https://your-issuer.example/",
        audience="https://your-api.example",
        key_provider=JWKSKeyProvider(
            "https://your-issuer.example/.well-known/jwks.json"
        ),
    ),
])

FastAPI integration

from demarche.fastapi import DemarcheAuth

auth = DemarcheAuth(verifier)


@app.get("/whoami")
async def whoami(
    agent: Annotated[VerificationResult, Depends(auth.require_agent)],
):
    return {"user": agent.principal_id, "agent": agent.agent_id}


@app.post("/book-meeting")
async def book_meeting(
    agent: Annotated[
        VerificationResult,
        Depends(auth.require_scope("calendar.write")),
    ],
):
    return {"booked_by": agent.principal_id}

A complete runnable example lives at examples/fastapi-app/.

Status

Pre-alpha — API surface is stabilising. See the project README and spec for full details.

License

Apache 2.0.