Vercel AI SDK keeps its own auth hook. Authdog stays the identity provider. The planned sample attaches an agent access token there and refuses the run when that token is missing or userinfo rejects it.

Sample planned at `ai-sdk/typescript` in [authdog/agents-samples](https://github.com/authdog/agents-samples). That folder is not published yet, so this page does not pin `ai`. Node.js.

Channel auth, machine credentials, tool checks, and instructions for this framework are the other pages under Vercel AI SDK in [AI](/docs/ai/ai-sdk/channel-auth).

## The hook

```typescript
const whoami = tool({
  description: "Return the Authdog subject. Do not invent one.",
  inputSchema: z.object({}),
  contextSchema: z.object({ token: z.string() }),
  execute: async (_input, { context }) => fetchSubject(context.token),
})
```

The caller passes the access token in `toolsContext.whoami.token`. `fetchSubject` sends it as `Authorization: Bearer` to a route that depends on `require_auth`. The model sees the tool result, which is the subject string. Tests call `execute` and the route. They do not call `generate`.

This is agent identity: `client_credentials`, then this hook. It is not [Agent Sign-In](/docs/agent-sign-in). A browser sign-in does not replace the hook.

## What you should see

The route with no token is `401`. `execute` with an empty token does not return a subject.

The route with a bearer userinfo accepts returns `{ subject: "<id>" }`. That string is the tool result.

`npm test` in `ai-sdk/typescript` is how the sample will prove both. It does not call a model.

## Configure

| Name | Purpose |
| --- | --- |
| `toolsContext.whoami.token` | Access token for this tool only. |
| `PK_AUTHDOG` | Public key on the API route. |

The shared exchange is in [Agent frameworks](/docs/agent-frameworks#mint-the-bearer). There is no refresh token. Repeat it before `expires_in`.

> **Caution**
>
> Do not commit the client secret, and do not put the access token in the prompt. The public key selects the identity host. It does not mint tokens.

## Related

| Read | To learn how to |
| --- | --- |
| [Agent frameworks](/docs/agent-frameworks) | Mint the bearer this hook checks |
| [Semantic Kernel](/docs/agent-frameworks/semantic-kernel) | The previous hook |
| [Strands Agents](/docs/agent-frameworks/strands) | The next hook |
| [Custom channel auth for Vercel AI SDK](/docs/ai/ai-sdk/channel-auth) | The same check, as the auth boundary |