Eve route auth takes a list of authenticators on the channel. Put Authdog's issuer and audience in `oidc()` and pass that function as the only entry. Session routes then require a bearer JWT Eve can verify from the issuer's discovery document.

Sample: [eve/typescript](https://github.com/authdog/agents-samples/tree/main/eve/typescript). Node.js 20+. Package `eve@0.81.1`.

This is inbound route auth: who may open a session. Outbound tool sign-in is a separate Eve concern and stays off this walk. An agent that signs into your product UI uses [Agent Sign-In](/docs/agent-sign-in).

## The walk

`agent/channels/authdog-oidc.mjs` reads the environment and returns Eve's OIDC authenticator:

```javascript
import { oidc } from "eve/channels/auth";

export function authdogOidc() {
  const issuer = process.env.AUTHDOG_ISSUER;
  const audience = process.env.AUTHDOG_AUDIENCE;
  if (!issuer || !audience) {
    throw new Error("AUTHDOG_ISSUER and AUTHDOG_AUDIENCE are required");
  }
  return oidc({
    issuer,
    audiences: [audience],
  });
}
```

`agent/channels/eve.ts` mounts it alone:

```typescript
import { eveChannel } from "eve/channels/eve";
import { authdogOidc } from "./authdog-oidc.mjs";

export default eveChannel({
  auth: [authdogOidc()],
});
```

`oidc()` verifies the bearer as a JWT against the issuer discovery document (`iss`, signature, expiry, audience). The Eve process holds no client secret. An opaque token fails this check. Mint the JWT from the same issuer, and set `AUTHDOG_AUDIENCE` to the `aud` that token carries.

The agent definition (`defineAgent`) stays the model. Identity lives on the channel.

## What you should see

`POST /eve/v1/session` with no `Authorization` header returns `401`.

Repeat the call with `Authorization: Bearer <access_token>` when `iss` matches `AUTHDOG_ISSUER` and `aud` matches `AUTHDOG_AUDIENCE`. Eve accepts the session only after that verification.

Eve's health route does not use this walk. A public health check is expected.

`npm test` in the sample asserts two things: the channel source lists `authdogOidc()` and does not list `localDev()`, `none()`, or `vercelOidc()`, and a session request with no bearer is `401`.

## Configure

| Variable | Purpose |
| --- | --- |
| `AUTHDOG_ISSUER` | Environment issuer, `https://<identity-host>/oidc/<environmentId>`. |
| `AUTHDOG_AUDIENCE` | Audience claim your agent tokens carry. |
| `OPENAI_API_KEY` | Only for `npx eve dev` chat. Tests do not call a model. |

```bash
npm install
export AUTHDOG_ISSUER=https://id.authdog.com/oidc/<environmentId>
export AUTHDOG_AUDIENCE=https://your-agent.example
npm test
```

To talk to the agent, export the same variables and run `npx eve dev` from the sample directory.

Leave `localDev()`, `none()`, and another vendor's workload identity off this list. A laptop process is not an Authdog subject.

## Related

| Read | To learn how to |
| --- | --- |
| [Agent frameworks](/docs/agent-frameworks) | Mint the bearer the channel verifies |
| [A2A](/docs/agent-frameworks/a2a) | Same identity, declared on an agent card |
| [MCP](/docs/agent-frameworks/mcp) | Same identity, on an MCP token verifier |