Skip to main content

Module auth

agentd

Module auth 

Source
Expand description

Endpoint authentication — the interactive & workload credential providers and the durable token cache they share (RFC 0031).

The existing static-header path (mcp::auth) and the AAuth request-signer (aauth) are the static/aauth providers. This module owns the new surfaces: the durable Kind::Cred cache, and the OAuth 2.1 / OIDC [oauth2] flows (device grant + refresh + discovery) that power agentd login. AWS SigV4/SSO and SPIFFE providers land behind the aws/spiffe features in later phases.

Modules§

cache
The durable endpoint-credential cache (RFC 0031 §11). Access + refresh tokens with expiry, persisted in the durable store under Kind::Cred, keyed by a hash of the login target (e.g. mcp:github, intelligence). Written by agentd login and read at daemon startup to seed a provider; refreshed in-memory during a run, re-loaded (and re-refreshed from the refresh token) on restart.