# Swarm Auth

- **Event:** [Built with Opus 4.7: a Claude Code hackathon](https://cerebralvalley.ai/e/built-with-4-7-hackathon)
- **When:** Apr 21 at 12:00 PM – Apr 27 at 2:00 AM (EDT)
- **Where:** Online
- **Team:** [Jonathan Olvera](https://cerebralvalley.ai/u/JohnOlven)
- **GitHub:** https://github.com/johnolven/agent-auth
- **Demo video:** https://youtu.be/yc5b_JSKvRA
- **Gallery:** https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery/241

agent_auth is an OAuth-style authentication and accountability protocol for AI agents. As autonomous agents proliferate — booking flights, drafting emails, moving money — there
  is no shared infrastructure for answering three urgent questions: who owns this agent, what is it actually allowed to do, and how much should I trust it?                       
                                                                                                                                                                                    
  The protocol solves this end-to-end. A human verifies themselves and registers their agent by submitting a plain-text skill.md manifest. Claude parses the manifest into
  structured capabilities, hard constraints, and a recommended trust tier, and generates a human-readable Identity Card. The assigned trust tier is min(ownerVerificationCap,       
  claudeRecommendedTier) — an agent can never inherit more trust than its owner has earned.                                                                                  
                                                                                                                                                                                    
  Any third-party tool integrates via two paths: a lightweight POST /api/agent/signin for backend-to-backend verification, or a full OAuth-style consent flow at /authorize that
  returns a short-lived JWT bearer token after the owner approves on a hosted consent screen — exactly like "Sign in with Google" but for AI agents. Every action the agent reports 
  through POST /api/events/log is audited live by Claude against its declared scope; out-of-scope or high-risk events trigger an immediate email to the human owner via Resend and 
  stream into a live event console at /dashboard/agent/[id]/events.                                                                                                                 
                                                                      
  Agents can be public (browseable trust badge at /agent/[id], for branded products) or private (only verifiable through our certifying API — the Visa-for-credit-cards model, where
   the merchant can ask "is this real?" without the card needing a public page). The result is a single source of truth that lets humans stay accountable, tools make instant trust 
  decisions, and anomalies surface in seconds.                                                                                                                                     
                                                                                                                                                                                    
  Stack: Next.js 14 App Router, MongoDB, NextAuth (email magic-link), Anthropic Claude (claude-opus-4-5), Resend.

---

Markdown version of https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery/241. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt