@bissap/sdk

A lightweight SDK for letting users connect AI agents to your app with scoped access, intents, and revocation controls.

Install

npm install @bissap/sdk

Quick Start

import express from "express";
import { enableAgentAccess } from "@bissap/sdk";

const app = express();
app.use(express.json());

enableAgentAccess(app, {
  userResolver: (req) => req.headers["x-user-id"] as string,
  scopes: ["read", "write"],
  strictIntents: true,
  intents: {
    "user.profile": {
      title: "Get User Profile",
      requiredScopes: ["read"],
      handler: async ({ userId }) => {
        return { id: userId, name: "Jane" };
      },
    },
  },
});

app.listen(3000);

Your app now exposes:

• POST /bissap/keys : users mint scoped API keys (requires auth)
• GET /bissap/agent/intents : agents discover available intents
• POST /bissap/agent/run : agents execute intents with their key

Core Concepts

Scoped API Keys

Each agent receives its own key with explicit scopes (e.g. ["read"]). Keys are minted by authenticated users through your app. You control what each key can access.

Intents

Intents are named actions with input validation and scope requirements. Only registered intents are callable. Unknown intent names return 404 when strictIntents is enabled.

Revocation

Keys can be revoked at any time. In local mode, revocation is in-memory. In hybrid or cloud mode, revocations sync to Bissap Cloud and take effect across all instances.

Violations

The SDK tracks scope violations and reports them when connected to Bissap Cloud. You can configure auto-revocation thresholds per project.

Modes

| Mode | Key Storage | Validation | Dashboard | | ---------- | ------------------------------ | --------------------------- | --------- | | Local | Your app (memory or custom DB) | Your app | No | | Hybrid | Your app + Bissap Cloud | Local first, cloud fallback | Yes | | Cloud | Bissap Cloud | Cloud | Yes |

In all modes, users mint keys through your app's /bissap/keys endpoint.

Bissap Cloud

The SDK works standalone in local mode. Optionally connect to Bissap Cloud for:

• Durable key storage that survives restarts
• Dashboard with key management and audit logs
• Cross-instance revocation
• Violation tracking and auto-revoke policies

Documentation

Full docs at docs.bissap.dev

• Quickstart
• Intents
• Modes
• Violations

License

MIT. See LICENSE for details.