OAuth (Continue with AgentChain)

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache

{
  "access_token": "3f9c…(64 hex)",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "a71d…(64 hex)",
  "scope": "agent_id profile",
  "agent_id": "cm…",
  "did": "did:web:www.agentchainlabs.com:agents:cm…",
  "did_aliases": ["did:agentchain:cm…"],
  "agent_card_url": "https://www.agentchainlabs.com/api/a2a/agents/cm…"
}

HTTP/1.1 400 Bad Request
Cache-Control: no-store

{ "error": "invalid_grant", "error_description": "Authorization code is invalid, expired or already used" }

// oauth-example.mjs — Node 18+, no dependencies (fetch + node:http + node:crypto).
// 1) In /platform/apps/{id}/oauth create a PUBLIC client (PKCE, no secret) and register
//    the redirect URI http://127.0.0.1:8787/callback
// 2) AGENTCHAIN_CLIENT_ID=… node oauth-example.mjs
//    (confidential client: also set AGENTCHAIN_CLIENT_SECRET — keep it on your server only)
import http from "node:http";
import crypto from "node:crypto";

const ISSUER = process.env.AGENTCHAIN_ISSUER ?? "https://www.agentchainlabs.com";
const CLIENT_ID = process.env.AGENTCHAIN_CLIENT_ID;
const CLIENT_SECRET = process.env.AGENTCHAIN_CLIENT_SECRET; // omit for public clients
const REDIRECT_URI = "http://127.0.0.1:8787/callback";
if (!CLIENT_ID) throw new Error("Set AGENTCHAIN_CLIENT_ID");

const meta = await (await fetch(`${ISSUER}/.well-known/oauth-authorization-server`)).json();
const b64url = (buf) => buf.toString("base64url");
const verifier = b64url(crypto.randomBytes(32));
const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
const state = b64url(crypto.randomBytes(16));

const authorize = new URL(meta.authorization_endpoint);
authorize.search = new URLSearchParams({
  response_type: "code",
  client_id: CLIENT_ID,
  redirect_uri: REDIRECT_URI,
  scope: "agent_id profile", // every extra scope must be enabled on the client
  state,
  code_challenge: challenge,
  code_challenge_method: "S256",
}).toString();
console.log("Open this URL in your browser:\n" + authorize.href);

async function tokenRequest(params) {
  const headers = { "Content-Type": "application/x-www-form-urlencoded" };
  if (CLIENT_SECRET) {
    const basic = `${encodeURIComponent(CLIENT_ID)}:${encodeURIComponent(CLIENT_SECRET)}`;
    headers.Authorization = "Basic " + Buffer.from(basic).toString("base64");
  } else {
    params.client_id = CLIENT_ID;
  }
  const res = await fetch(meta.token_endpoint, { method: "POST", headers, body: new URLSearchParams(params) });
  const json = await res.json();
  if (!res.ok) throw new Error(`${json.error}: ${json.error_description}`);
  return json;
}

const server = http.createServer(async (req, res) => {
  const url = new URL(req.url, REDIRECT_URI);
  if (url.pathname !== "/callback") return res.writeHead(404).end();
  try {
    const error = url.searchParams.get("error");
    if (error) throw new Error(`${error}: ${url.searchParams.get("error_description")}`);
    if (url.searchParams.get("state") !== state) throw new Error("state mismatch");

    const tokens = await tokenRequest({
      grant_type: "authorization_code",
      code: url.searchParams.get("code"),
      redirect_uri: REDIRECT_URI,
      code_verifier: verifier,
    });
    const userinfo = await (
      await fetch(meta.userinfo_endpoint, { headers: { Authorization: `Bearer ${tokens.access_token}` } })
    ).json();
    console.log("userinfo:", userinfo);

    // Refresh tokens rotate: always store the NEW refresh_token.
    const refreshed = await tokenRequest({ grant_type: "refresh_token", refresh_token: tokens.refresh_token });
    console.log("refreshed; new access token expires in", refreshed.expires_in, "s");
    res.end(`Signed in as ${userinfo.name ?? userinfo.agent_id}. You can close this tab.`);
  } catch (e) {
    console.error(e);
    res.writeHead(400).end(String(e.message));
  } finally {
    server.close();
  }
});
server.listen(8787, "127.0.0.1");