Authentication

AGP uses OAuth 2.0 client credentials. Auth is opt-in — set AGP_AUTH_SECRET to enable it. Unset means open server, useful for development and conformance testing.

Token endpoint

Exchange client credentials for a short-lived bearer token (1 hour TTL by default).

• POST /oauth/token

Server configuration

Three environment variables control auth on the reference server.

• AGP_AUTH_SECRET — enables auth (HS256 signing key)
• AGP_CLIENT_ID — bootstrap client ID
• AGP_CLIENT_SECRET — bootstrap client secret

SDKs handle tokens

Pass client_id and client_secret to the client constructor. Token fetch, caching, and refresh happen automatically.

# Obtain a token manually
curl -X POST https://your-agp-server/oauth/token \
  -d "grant_type=client_credentials&client_id=my-agent&client_secret=s3cr3t"

# Response
{
  "access_token": "eyJ...",
  "token_type":   "bearer",
  "expires_in":   3600,
  "scope":        "agp.registry.write agp.decision.write agp.execution.write"
}