Vercel AI SDK

Vercel AI SDK keeps its own auth hook. Authdog stays the identity provider. The planned sample attaches an agent access token there and refuses the run when that token is missing or userinfo rejects it.

Sample planned at ai-sdk/typescript in authdog/agents-samples. That folder is not published yet, so this page does not pin ai. Node.js.

Channel auth, machine credentials, tool checks, and instructions for this framework are the other pages under Vercel AI SDK in AI.

The hook

const whoami = tool({
  description: "Return the Authdog subject. Do not invent one.",
  inputSchema: z.object({}),
  contextSchema: z.object({ token: z.string() }),
  execute: async (_input, { context }) => fetchSubject(context.token),
})

The caller passes the access token in toolsContext.whoami.token. fetchSubject sends it as Authorization: Bearer to a route that depends on require_auth. The model sees the tool result, which is the subject string. Tests call execute and the route. They do not call generate.

This is agent identity: client_credentials, then this hook. It is not Agent Sign-In. A browser sign-in does not replace the hook.

What you should see

The route with no token is 401. execute with an empty token does not return a subject.

The route with a bearer userinfo accepts returns { subject: "<id>" }. That string is the tool result.

npm test in ai-sdk/typescript is how the sample will prove both. It does not call a model.

Configure

The shared exchange is in Agent frameworks. There is no refresh token. Repeat it before expires_in.

Related