theAuth for AI Agents: Identity and Scoped Permissions

Description and use

The article explains replacing a shared API key used by multiple AI agents with individual tokens that have scoped permissions, enabling auditability and per-agent revocation.

Problem

A shared human API key used by multiple AI agents and scripts caused broad permissions, difficulty revoking individual agents, and a misleading audit trail.

Outcome

Agents operate with minimal blast radius, can be revoked individually, and actions are auditable per agent.

Workflow

• Install Node 20+, TypeScript, and theauth package
• Create a SQLite database instance with agents enabled
• Seed an owner user row
• Create one agent per job using theauth.agent.create
• Call authorize() before each agent action
• Add constraints such as rate limits and argument patterns
• Check tokens in middleware to return 401/403
• Delegate to sub-agents with narrower scopes
• Read audit trail, rotate, and revoke tokens

Evidence

A shared human key has three problems, and they stack.

Source

Each agent holds a token that maps to one row, one owner, and one permission list.

Source

Call authorize() before every action

Source