Authentication

Detection tells you what kind of agent is on the page. Authentication tells you which agent, and — when it acts for someone — for whom. Agentronics verifies four methods today, the ones agents actually use:

Authentication never blocks. A verified agent gets an identity your code and policies can use; an agent that proves nothing — or a human — browses exactly as before. What an identity unlocks is up to your authorization rules.

Where it runs

Most agents never run your page's JavaScript, so authentication happens on your server, from the HTTP request:

// middleware.ts (Next.js)
import { agentronicsMiddleware } from '@agentronics/sdk/next'
 
export default agentronicsMiddleware({
  // Web Bot Auth and verified crawlers are on by default
  apiKey: { verify: sync.keyVerifier() },                         // keys minted in the console
  oauth2: { issuer: 'https://auth.shop.example', audience: 'https://shop.example' },
})

Your routes read the result from x-agentronics-* request headers (incoming copies are stripped, so they can't be forged):

import { readAgentHeaders } from '@agentronics/sdk/server'
 
const agent = readAgentHeaders(request.headers)
// → { status: 'verified', id: 'https://chatgpt.com', name: 'ChatGPT agent', method: 'web-bot-auth', vendor: 'OpenAI' }

Outside Next.js use createAgentAuth() (any Fetch Request), createAgentAuthHandler() or expressAgentAuth() from @agentronics/sdk/server. Methods run strongest first — Web Bot Auth, then API key / OAuth, then crawler checks — and the first that verifies wins.

The trust ladder

Verified server-side identities are traced with class crawler (HTTP fetchers) and metadata.protocol set to the method, so they appear on the console's Auth page next to in-browser agents.

In the browser

Agents that run inside the page (WebMCP, browser extensions) can present credentials to the browser SDK with client.authenticate() or client.presentIdentity(). The browser can't check a token on its own, so an unchecked token is declared, never verified — wire auth.verifyToken to your backend (which calls the server SDK) to upgrade it:

const client = Agentronics.init({
  publishableKey: process.env.NEXT_PUBLIC_AGENTRONICS_KEY!,
  auth: {
    verifyToken: async (method, token) => {
      const res = await fetch('/api/agentronics/verify', { method: 'POST', body: JSON.stringify({ method, token }) })
      return res.ok ? res.json() : null // a VerificationResult, or null
    },
  },
})

Coming later

These are built but off by default until they ship in the console:

• Enterprise agent SSO — ID-JAG / Cross App Access (Okta Agent SSO, Microsoft Entra Agent ID, Auth0).
• Workload identity — SPIFFE, including Google Agent Identity.
• mTLS — client certificates, server-side.

To try them in the browser SDK: createAuthEngine({ methods: [...defaultAuthMethods(), ...previewAuthMethods()] }).