Eve

Eve route auth takes a list of authenticators on the channel. Put Authdog's issuer and audience in oidc() and pass that function as the only entry. Session routes then require a bearer JWT Eve can verify from the issuer's discovery document.

Sample: eve/typescript. Node.js 20+. Package [email protected].

This is inbound route auth: who may open a session. Outbound tool sign-in is a separate Eve concern and stays off this walk. An agent that signs into your product UI uses Agent Sign-In.

The walk

agent/channels/authdog-oidc.mjs reads the environment and returns Eve's OIDC authenticator:

import { oidc } from "eve/channels/auth";

export function authdogOidc() {
  const issuer = process.env.AUTHDOG_ISSUER;
  const audience = process.env.AUTHDOG_AUDIENCE;
  if (!issuer || !audience) {
    throw new Error("AUTHDOG_ISSUER and AUTHDOG_AUDIENCE are required");
  }
  return oidc({
    issuer,
    audiences: [audience],
  });
}

agent/channels/eve.ts mounts it alone:

import { eveChannel } from "eve/channels/eve";
import { authdogOidc } from "./authdog-oidc.mjs";

export default eveChannel({
  auth: [authdogOidc()],
});

oidc() verifies the bearer as a JWT against the issuer discovery document (iss, signature, expiry, audience). The Eve process holds no client secret. An opaque token fails this check. Mint the JWT from the same issuer, and set AUTHDOG_AUDIENCE to the aud that token carries.

The agent definition (defineAgent) stays the model. Identity lives on the channel.

What you should see

POST /eve/v1/session with no Authorization header returns 401.

Repeat the call with Authorization: Bearer <access_token> when iss matches AUTHDOG_ISSUER and aud matches AUTHDOG_AUDIENCE. Eve accepts the session only after that verification.

Eve's health route does not use this walk. A public health check is expected.

npm test in the sample asserts two things: the channel source lists authdogOidc() and does not list localDev(), none(), or vercelOidc(), and a session request with no bearer is 401.

Configure

npm install
export AUTHDOG_ISSUER=https://id.authdog.com/oidc/<environmentId>
export AUTHDOG_AUDIENCE=https://your-agent.example
npm test

To talk to the agent, export the same variables and run npx eve dev from the sample directory.

Leave localDev(), none(), and another vendor's workload identity off this list. A laptop process is not an Authdog subject.

Related