🦍OpenApe
Ecosystem

OpenApe Auth

DNS-based identity for humans and agents.

OpenApe Auth

@openape/core

The foundation package. Framework-agnostic, zero dependencies.

  • DNS Discovery — resolve _ddisa.{domain} TXT records to find the IdP
  • PKCE — code challenge/verifier generation for secure OAuth flows
  • JWT — sign, verify, and validate DDISA assertion tokens
  • Types — DDISAAssertionClaims, ActorType, AuthFlowState, etc.

@openape/auth

Complete OIDC login protocol logic — both sides in one package.

IdP Side

  • handleAuthorize() — validate authorization requests
  • handleTokenExchange() — exchange codes for signed assertions
  • issueAssertion() — create minimal AuthN-JWTs with act claim
  • WebAuthn — createRegistrationOptions(), verifyRegistration(), createAuthenticationOptions(), verifyAuthentication()

SP Side

  • discoverIdP() — DNS-based IdP discovery via DoH
  • createAuthorizationURL() — build OAuth redirect with PKCE
  • handleCallback() — exchange code, validate assertion

@openape/nuxt-auth-idp

Drop-in Nuxt module. Add it, configure it, you're an IdP.

Auto-registered routes:

  • /login, /register, /account — Passkey-based UI (overridable)
  • /admin — User and agent management
  • /authorize, /token — OAuth endpoints
  • /.well-known/jwks.json — Public key discovery
  • /api/webauthn/* — Registration and login flows
  • /api/session/ssh-keys — SSH-key enrollment and listing (see below)
  • /api/auth/* — Unified challenge/authenticate for SSH-key auth (humans + agents)
  • /api/admin/* — User, agent, and registration URL management

Configuration via openapeIdp in nuxt.config.ts:

openapeIdp: {
  rpName: 'My IdP',
  rpID: 'id.example.com',
  rpOrigin: 'https://id.example.com',
  requireUserVerification: true,  // NIS2 strict mode
  residentKey: 'required',        // true passkey experience
  attestationType: 'none',        // or 'direct' for enterprise
}

See the dedicated nuxt-auth-idp docs for the full module option surface, environment variables, and store interfaces.

SSH-key authentication

Alongside passkeys, the IdP accepts Ed25519 SSH keys as a first-class credential for agents (and humans who prefer key-based auth, e.g. CI scripts). Keys are email-keyed — they are not bound to an RP, so the same SSH key authenticates against every hostname the IdP serves.

Manage keys on a logged-in user account:

RoutePurpose
GET /api/session/ssh-keysList keys registered to the caller's account
POST /api/session/ssh-keysAdd a public key — body { publicKey: string, name?: string }
DELETE /api/session/ssh-keys/:keyIdRemove a key

The publicKey field accepts the standard OpenSSH one-line format (ssh-ed25519 AAAA… comment). The comment is captured as the key's display name if name is omitted.

Authenticate with an SSH key (challenge/response, used by @openape/apes and escapes):

POST /api/auth/challenge   { email, publicKey }
→  { challenge: "<random>", challengeId: "<id>" }

(client signs the challenge with the matching private key)

POST /api/auth/authenticate  { challengeId, signature }
→  { token: "<JWT>" }

The returned JWT carries the same act claim discipline as passkey sessions (human or agent). SPs verifying the token do not need to distinguish the authentication method.

Admin-side key management is available at /api/admin/users/:email/ssh-keys — GET, POST, DELETE /:keyId — for operators provisioning CI or agent keys on behalf of users.

@openape/nuxt-auth-sp

Drop-in Nuxt module. Stateless. Zero server storage.

Auto-registered routes:

  • /api/login — initiate DDISA login flow
  • /api/callback — handle OAuth callback
  • /api/logout — destroy session
  • /api/me — current user info
  • /.well-known/sp-manifest.json — SP metadata

Composable: useOpenApeAuth() for client-side auth state.

Component: <OpenApeAuth /> — prebuilt login form with customizable slots and CSS variables.

See the dedicated nuxt-auth-sp docs for full API reference.

Overview

The OpenApe package ecosystem.

OpenApe Grants

Human-in-the-loop permissions for agents.