Add Sign in with Agentboxd to your app

import { Agentboxd } from 'agentboxd';

const RP_URL = 'https://app.example.com';
const mr = new Agentboxd(); // AGENTBOXD_API_KEY: a key with identity:sign (preset "sign_in")

// Optional: ask the app for a nonce, so the token is bound to this login attempt.
const { nonce } = await (await fetch(`${RP_URL}/login/nonce`)).json();

// A 5-minute, single-use ID token addressed to this app only.
const { id_token } = await mr.identity.token({
  inboxId: process.env.INBOX_ID!,
  audience: process.env.AGENTBOXD_CLIENT_ID!, // the app's client_id
  nonce,
});

const res = await fetch(`${RP_URL}/login/verify`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ id_token, nonce }),
});

import { AgentIdentityError, MemoryReplayCache, verifyAgentIdentityToken } from 'agentboxd/identity';

const CLIENT_ID = process.env.AGENTBOXD_CLIENT_ID!;
/** One process: in memory. Several processes: back it with Redis (SET jti 1 NX EXAT exp). */
const replayCache = new MemoryReplayCache();

export async function verifyAgent(idToken: string, nonce?: string) {
  try {
    const agent = await verifyAgentIdentityToken(idToken, {
      audience: CLIENT_ID,
      ...(nonce ? { nonce } : {}),
      replayCache, // a second presentation of the same jti is rejected
    });
    // agent.sub is pairwise: stable for this app, different at every other app.
    return { sub: agent.sub, email: agent.email, name: agent.name, isAgent: agent.isAgent };
  } catch (err) {
    if (err instanceof AgentIdentityError) throw new Error(`sign-in refused: ${err.code}`); // token_replayed, token_expired, ...
    throw err;
  }
}

const ISSUER = 'https://id.agentboxd.com';
const basic = Buffer.from(`${encodeURIComponent(CLIENT_ID)}:${encodeURIComponent(CLIENT_SECRET)}`).toString('base64');

const res = await fetch(`${ISSUER}/token`, {
  method: 'POST',
  headers: { Authorization: `Basic ${basic}`, 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: idToken }),
});
const tokens = await res.json();
// invalid_grant: expired, wrong audience, sign-in turned off for the inbox, or already used.
if (!res.ok) throw new Error(tokens.error);

// A fresh ID token (new jti, no nonce): verify it like any other.
const agent = await verifyAgentIdentityToken(tokens.id_token, { audience: CLIENT_ID });

curl -X POST https://id.agentboxd.com/token \
  -u "$AGENTBOXD_CLIENT_ID:$AGENTBOXD_CLIENT_SECRET" \
  -d grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer \
  -d assertion="$ID_TOKEN"

# 200 { "access_token": "abxat_...", "token_type": "Bearer", "expires_in": 300,
#       "id_token": "eyJ...", "scope": "openid email" }
# A second exchange of the same token: 400 { "error": "invalid_grant" }

import { betterAuth } from 'better-auth';
import { genericOAuth } from 'better-auth/plugins';

const ISSUER = process.env.AGENTBOXD_ISSUER ?? 'https://id.agentboxd.com';

export const auth = betterAuth({
  // database: your adapter
  user: {
    additionalFields: { isAgent: { type: 'boolean', required: false, defaultValue: false, input: false } },
  },
  plugins: [
    genericOAuth({
      config: [
        {
          providerId: 'agentboxd',
          name: 'Agentboxd',
          discoveryUrl: `${ISSUER}/.well-known/openid-configuration`,
          clientId: process.env.AGENTBOXD_CLIENT_ID!,
          clientSecret: process.env.AGENTBOXD_CLIENT_SECRET!,
          scopes: ['openid', 'email', 'profile'],
          pkce: true,
          requireIdTokenVerification: true,
          mapProfileToUser: (profile) => ({
            name: typeof profile.name === 'string' ? profile.name : undefined,
            email: typeof profile.email === 'string' ? profile.email : null,
            emailVerified: profile.email_verified === true,
            isAgent: profile['https://agentboxd.com/claims/agent'] === true,
          }),
        },
      ],
    }),
  ],
});

// In the browser:
// await authClient.signIn.social({ provider: 'agentboxd', callbackURL: '/dashboard' });

import type { OIDCConfig, OIDCUserConfig } from '@auth/core/providers';

export interface AgentboxdProfile extends Record<string, unknown> {
  sub: string;
  email?: string;
  email_verified?: boolean;
  name?: string;
  'https://agentboxd.com/claims/agent': true;
}

export default function Agentboxd(options: OIDCUserConfig<AgentboxdProfile>): OIDCConfig<AgentboxdProfile> {
  return {
    id: 'agentboxd',
    name: 'Agentboxd',
    type: 'oidc',
    issuer: 'https://id.agentboxd.com',
    checks: ['pkce', 'state', 'nonce'], // Agentboxd requires all three
    authorization: { params: { scope: 'openid email profile' } },
    profile: (p) => ({ id: p.sub, name: p.name ?? p.email ?? null, email: p.email ?? null, image: null }),
    options,
  };
}

// auth.ts (Next.js, next-auth v5)
import NextAuth from 'next-auth';
import Agentboxd from './agentboxd-provider';

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [Agentboxd({ clientId: process.env.AUTH_AGENTBOXD_ID, clientSecret: process.env.AUTH_AGENTBOXD_SECRET })],
  callbacks: {
    jwt({ token, profile }) {
      if (profile) token.isAgent = profile['https://agentboxd.com/claims/agent'] === true;
      return token;
    },
  },
});