@openleash/sdk

TypeScript SDK for AI agents to integrate with OpenLeash.

This package is a placeholder. The full implementation is under active development.

What is OpenLeash?

OpenLeash is a local-first authorization and proof sidecar for AI agents. Agents call OpenLeash before performing side-effectful actions (purchases, bookings, API calls, government submissions) and receive a decision plus an optional cryptographic proof token.

What does @openleash/sdk provide?

This SDK is the client library that agents use to communicate with an OpenLeash sidecar:

• generateEd25519Keypair() — Generate a new Ed25519 keypair for agent identity and request signing.
• signRequest() — Compute Ed25519 signatures over request headers (X-Agent-Id, X-Timestamp, X-Nonce, X-Body-Sha256, X-Signature) as required by the OpenLeash protocol.
• registrationChallenge() — Request a challenge from the OpenLeash server to begin agent registration.
• registerAgent() — Complete agent registration by signing the challenge.
• authorize() — Sign and submit an ActionRequest to /v1/authorize and receive a DecisionResult with obligations and optional proof token.
• verifyProofOnline() — Verify a proof token by calling the OpenLeash server's /v1/verify-proof endpoint.
• verifyProofOffline() — Verify a PASETO v4.public proof token locally using provided public keys, without contacting the server.

Quick Example

import { authorize, verifyProofOffline } from '@openleash/sdk';

// Agent requests authorization for a purchase
const result = await authorize({
  openleashUrl: 'http://127.0.0.1:8787',
  agentId: 'my-shopping-agent',
  privateKeyB64: process.env.OPENLEASH_AGENT_PRIVATE_KEY_B64,
  action: {
    action_id: crypto.randomUUID(),
    action_type: 'purchase',
    requested_at: new Date().toISOString(),
    principal: { agent_id: 'my-shopping-agent' },
    subject: { principal_id: 'owner-uuid' },
    payload: { amount_minor: 5000, currency: 'USD', merchant_domain: 'amazon.com' }
  }
});

if (result.result === 'ALLOW' && result.proof_token) {
  // Counterparty can verify the proof
  const verification = await verifyProofOffline({
    token: result.proof_token,
    publicKeys: [/* from GET /v1/public-keys */]
  });
}

Installation

npm install @openleash/sdk

Status

This package is under active development. See the OpenLeash repository for progress and documentation.

Links

• OpenLeash website
• GitHub repository
• OpenClaw — agent runtime that integrates with OpenLeash

License

MIT