Nuvouch Agent Auth

Agent Auth runtime and provider SDK for Nuvouch.

Use this package when an agent runtime, harness, plugin, or tool provider needs Agent Auth without pulling in the full Nuvouch server SDK.

Runtime Usage

Runtime calls do not use a Nuvouch API key. Pairing starts with a runtime-generated key-bound QR, then the user scans it in Nuvouch mobile to generate a one-time code. The runtime claims the connection by signing that code with the private key that created the QR.

import {
  createAgentAuthRuntimePairingRequest,
  createAgentAuthRuntimeClient,
  buildAgentAuthRuntimeClaimPayload,
  signAgentAuthRuntimePayload,
} from "@nuvouch/agent-auth";

const runtime = createAgentAuthRuntimeClient();
const pairing = createAgentAuthRuntimePairingRequest({
  applicationId: "app_openclaw",
  runtimeDisplayName: "OpenClaw Desktop",
});

// Render pairing.qrData as a QR code. The user scans it in Nuvouch mobile
// and gives the generated code back to the runtime.
const code = "NVP1-...";
const payload = buildAgentAuthRuntimeClaimPayload({ code });

await runtime.claimConnection({
  code,
  publicKeyFingerprint: pairing.publicKeyFingerprint,
  signature: signAgentAuthRuntimePayload({
    privateKey: pairing.keyPair.privateKey,
    keyAlgorithm: pairing.keyPair.keyAlgorithm,
    payload,
  }),
});

Provider Usage

Provider calls use the provider's own Nuvouch API key to validate delegation tokens and manage provider-owned Agent Auth state.

import { createAgentAuthProviderClient } from "@nuvouch/agent-auth";

const provider = createAgentAuthProviderClient({
  apiKey: serverSideNuvouchApiKey,
});

const delegation = await provider.requireActiveDelegation({
  token: delegationTokenFromRuntime,
});

Package Boundary

• @nuvouch/agent-auth: Agent Auth runtime/provider protocol helpers.
• @nuvouch/node: general Nuvouch server SDK for approvals, links, connections, and webhooks.
• @nuvouch/openclaw: official OpenClaw plugin built on this package.