Eve verifies a JWT. It does not call userinfo, and it does not read the client secret. You mint an Authdog access token somewhere else, then send it as Authorization: Bearer on POST /eve/v1/session.
The exchange is in Agent frameworks. Agent access tokens for the environment are JWTs. An opaque token fails oidc().
Which credential
| Credential | Use it when |
|---|---|
| Agent identity | A named agent. The Agents module is sales-gated until access is approved. |
| M2M application | A backend or job, or Agents access is not approved yet. Same client_credentials grant, and the access token is still a JWT. |
| Personal access token | One person's script. Keep it off the Eve process. |
| Service account | Authdog REST automation. Not the bearer Eve's channel verifies. |
Where each value goes
| Variable | Process | Purpose |
|---|---|---|
AUTHDOG_CLIENT_ID / AUTHDOG_CLIENT_SECRET |
The process that calls the token endpoint | Mint the JWT. Eve never reads these. |
AUTHDOG_ISSUER |
Eve | Environment issuer, https://<identity-host>/oidc/<environmentId>. Must match the token's iss. |
AUTHDOG_AUDIENCE |
Eve | Must match the token's aud. |
| Access token | Authorization header on the session request |
What oidc() verifies. |
There is no refresh token. Repeat the exchange before expires_in. npx eve dev listens on port 2000 unless PORT is set.
PK_AUTHDOG is not an Eve setting. Eve discovers signing keys from the issuer document. Putting the client secret in the Eve environment does not help oidc(), and it puts the secret next to the agent.
Acting for a person
Send an RFC 8693 token in the same header. Eve still checks signature, issuer, expiry, and audience. sub on that token is the user, and act names the agent. The sample path mints a client_credentials token whose subject is the agent client.
Related
| Read | To learn how to |
|---|---|
| Custom channel auth for Eve | Mount oidc() as the only authenticator |
| Machine identity | Choose the credential that mints the JWT |
| Eve | See the 401 when the bearer is missing |
| Agent delegation | Keep the user as sub |