Let AI agents sign in to your app.

import { betterAuth } from 'better-auth';
import { genericOAuth } from 'better-auth/plugins';

const ISSUER = process.env.AGENTBOXD_ISSUER ?? 'https://id.agentboxd.com';

export const auth = betterAuth({
  // database: your adapter
  user: {
    additionalFields: { isAgent: { type: 'boolean', required: false, defaultValue: false, input: false } },
  },
  plugins: [
    genericOAuth({
      config: [
        {
          providerId: 'agentboxd',
          name: 'Agentboxd',
          discoveryUrl: `${ISSUER}/.well-known/openid-configuration`,
          clientId: process.env.AGENTBOXD_CLIENT_ID!,
          clientSecret: process.env.AGENTBOXD_CLIENT_SECRET!,
          scopes: ['openid', 'email', 'profile'],
          pkce: true,
          requireIdTokenVerification: true,
          mapProfileToUser: (profile) => ({
            name: typeof profile.name === 'string' ? profile.name : undefined,
            email: typeof profile.email === 'string' ? profile.email : null,
            emailVerified: profile.email_verified === true,
            isAgent: profile['https://agentboxd.com/claims/agent'] === true,
          }),
        },
      ],
    }),
  ],
});

// In the browser:
// await authClient.signIn.social({ provider: 'agentboxd', callbackURL: '/dashboard' });

import type { OIDCConfig, OIDCUserConfig } from '@auth/core/providers';

export interface AgentboxdProfile extends Record<string, unknown> {
  sub: string;
  email?: string;
  email_verified?: boolean;
  name?: string;
  'https://agentboxd.com/claims/agent': true;
}

export default function Agentboxd(options: OIDCUserConfig<AgentboxdProfile>): OIDCConfig<AgentboxdProfile> {
  return {
    id: 'agentboxd',
    name: 'Agentboxd',
    type: 'oidc',
    issuer: 'https://id.agentboxd.com',
    checks: ['pkce', 'state', 'nonce'], // Agentboxd requires all three
    authorization: { params: { scope: 'openid email profile' } },
    profile: (p) => ({ id: p.sub, name: p.name ?? p.email ?? null, email: p.email ?? null, image: null }),
    options,
  };
}

curl https://id.agentboxd.com/.well-known/openid-configuration

# Configure any OpenID Connect client with:
#   issuer         https://id.agentboxd.com
#   client_id      abxc_...      (register the app in the dashboard, Identity)
#   client_secret  abxs_...      (server apps only; shown once)
#   scopes         openid email profile
#   flow           authorization code + PKCE (S256), with state and nonce

curl -X POST https://id.agentboxd.com/token \
  -u "$AGENTBOXD_CLIENT_ID:$AGENTBOXD_CLIENT_SECRET" \
  -d grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer \
  -d assertion="$ID_TOKEN"

# 200 { "access_token": "abxat_...", "token_type": "Bearer", "expires_in": 300,
#       "id_token": "eyJ...", "scope": "openid email" }
# A second exchange of the same token: 400 { "error": "invalid_grant" }