Eve authorizes inbound requests with a list of authenticators on the channel. Put Authdog's issuer and audience in `oidc()` and pass that function as the only entry. Session routes then require a bearer JWT Eve can verify from the issuer's discovery document.

Getting started, including the runnable sample, is [Eve](/docs/agent-frameworks/eve). This is who may open a session. Outbound tool sign-in is a separate Eve concern and stays off this walk.

## The authenticator

`agent/channels/authdog-oidc.mjs` reads the environment and returns Eve's OIDC authenticator:

```javascript
import { oidc } from "eve/channels/auth";

export function authdogOidc() {
  const issuer = process.env.AUTHDOG_ISSUER;
  const audience = process.env.AUTHDOG_AUDIENCE;
  if (!issuer || !audience) {
    throw new Error("AUTHDOG_ISSUER and AUTHDOG_AUDIENCE are required");
  }
  return oidc({
    issuer,
    audiences: [audience],
  });
}
```

Mount it alone:

```typescript
import { eveChannel } from "eve/channels/eve";
import { authdogOidc } from "./authdog-oidc.mjs";

export default eveChannel({
  auth: [authdogOidc()],
});
```

`oidc()` verifies the bearer as a JWT against the issuer discovery document: signature, issuer, expiry, and audience. An opaque token fails this check. Mint a JWT from the same issuer, and set `AUTHDOG_AUDIENCE` to the `aud` that token carries.

The Eve process holds no client secret and no `PK_AUTHDOG`. Identity lives on the channel. `defineAgent` stays the model.

## What else stays off the list

Leave `localDev()`, `none()`, and another vendor's workload identity off `auth`. A laptop process is not an Authdog subject. The sample's test fails if the channel lists those next to `authdogOidc()`.

Eve's health route does not use this walk. A public health check is expected. `POST /eve/v1/session` with no `Authorization` header returns `401`.

## Related

| Read | To learn how to |
| --- | --- |
| [Eve](/docs/agent-frameworks/eve) | Run `npm test` and `npx eve dev` |
| [API keys and M2M for Eve](/docs/ai/eve/api-keys-and-m2m) | Set issuer and audience from a real token |
| [Authorizing tool calls for Eve](/docs/ai/eve/authorize-tool-calls) | Authorize the API a tool calls |
| [Agent frameworks](/docs/agent-frameworks#eve-checks-the-jwt) | See why Eve verifies the JWT itself |