theAuth for AI Agents: Identity and Scoped Permissions

说明与用途

文章说明如何将多个 AI 代理使用的共享 API 密钥替换为具有受限权限的单独令牌，实现审计和单独撤销每个令牌的功能。

问题

A shared human API key used by multiple AI agents and scripts caused broad permissions, difficulty revoking individual agents, and a misleading audit trail.

结果

Agents operate with minimal blast radius, can be revoked individually, and actions are auditable per agent.

工作流

• Install Node 20+, TypeScript, and theauth package
• Create a SQLite database instance with agents enabled
• Seed an owner user row
• Create one agent per job using theauth.agent.create
• Call authorize() before each agent action
• Add constraints such as rate limits and argument patterns
• Check tokens in middleware to return 401/403
• Delegate to sub-agents with narrower scopes
• Read audit trail, rotate, and revoke tokens

证据

A shared human key has three problems, and they stack.

来源

Each agent holds a token that maps to one row, one owner, and one permission list.

来源

Call authorize() before every action

来源