OAuth 2.0 for AI Agents

AI agents are acting without permission

Today's AI frameworks offer no standard way to authorize, audit, or revoke what agents do on behalf of humans.

Attackers have already figured this out

Agents use shared secrets with no identity, no scoping, and no revocation. The numbers from 2025 speak for themselves.

Confirmed 2025–2026 incidents

Read the full analysis: 4 Agent Security Breaches That Should Change How You Think About API Keys

When an agent acts, who is legally responsible?

Your security tools have a blind spot

Grantex is not a replacement for Vault or Secrets Manager — it is the missing agent identity layer that works alongside them.

The regulatory pressure is already here

OWASP, EU AI Act, and NIST now require agent-level identity, scoping, revocation, and audit trails. Grantex covers every requirement.

Full mapping: Compliance Matrix · OWASP deep-dive blog post

Delegated authorization, done right

Five steps from consent to revocation, all enforced by cryptography.

Up and running in minutes

Install the SDK and authorize your first agent in under 10 lines.

// npm install @grantex/sdk
import { Grantex, verifyGrantToken } from '@grantex/sdk';

const grantex = new Grantex({ apiKey: 'YOUR_API_KEY' });

// 1. Request authorization — redirect user to consentUrl
const { consentUrl } = await grantex.authorize({
  agentId:  'ag_01J...',
  userId:   'usr_01J...',
  scopes:  ['calendar:read', 'email:send'],
});

// 2. Exchange the authorization code for a grant token
const token = await grantex.tokens.exchange({ code, agentId: 'ag_01J...' });

// 3. Verify offline — no network call needed
const grant = await verifyGrantToken(token.grantToken, {
  jwksUri: 'https://api.grantex.dev/.well-known/jwks.json',
});
console.log(grant.scopes); // ['calendar:read', 'email:send']

# pip install grantex
from grantex import Grantex, ExchangeTokenParams

client = Grantex(api_key="YOUR_API_KEY")

# 1. Request authorization — redirect user to consent_url
auth = client.authorize(
    agent_id="ag_01J...",
    user_id="usr_01J...",
    scopes=["calendar:read", "email:send"],
)

# 2. Exchange the authorization code for a grant token
token = client.tokens.exchange(ExchangeTokenParams(code=code, agent_id="ag_01J..."))

# 3. Use the token — scopes, grantId, and JWT are all available
print(token.scopes)      # ('calendar:read', 'email:send')
print(token.grant_token) # RS256-signed JWT

# npm install -g @grantex/cli
# All commands support --json for AI agent / script use

# 1. Request authorization (sandbox auto-approves)
grantex authorize --agent ag_01J... --principal user@example.com \
  --scopes calendar:read,email:send

# 2. Exchange the code for a grant token
grantex tokens exchange --code <code> --agent-id ag_01J...

# 3. Verify the token
grantex tokens verify <jwt>

# Machine-readable output
grantex --json grants list | jq '.[0].grantId'

Agent Identity for Machine Payments

MPP defines how agents pay for services. Grantex adds the missing identity layer — so merchants know exactly who authorized every payment.

import { requireAgentPassport } from '@grantex/mpp';

// One line to protect any route
app.use('/api/inference', requireAgentPassport({
  requiredCategories: ['inference'],
  maxAmount: 10,
}));

// req.agentPassport is populated:
//   humanDID:    did:grantex:user_alice
//   orgDID:      did:web:acme.com
//   categories:  [inference, compute]
//   maxAmount:   50 USDC
//   depth:       0 (direct grant)

const passport = await grantex.passports.issue({
  agentId: 'ag_01HXYZ...',
  grantId: 'grnt_01HXYZ...',
  allowedMPPCategories: ['inference', 'compute'],
  maxTransactionAmount: { amount: 50, currency: 'USDC' },
});
const mw = createMppPassportMiddleware({ passport });

Agent Spend Authorization for x402

x402 lets agents pay for APIs with USDC on Base L2. Grantex adds the missing layer — proving the agent was authorized to spend before any payment goes through.

import { generateKeyPair, issueGDT } from '@grantex/x402';

const principal = generateKeyPair();
const agent = generateKeyPair();

const gdt = await issueGDT({
  agentDID: agent.did,
  scope: ['weather:read'],
  spendLimit: { amount: 10, currency: 'USDC', period: '24h' },
  expiry: '24h',
  signingKey: principal.privateKey,
});

import { x402Middleware } from '@grantex/x402';

app.use('/api/weather', x402Middleware({
  requiredScopes: ['weather:read'],
  currency: 'USDC',
}));

// req.gdt is populated:
//   agentDID:       did:key:z6Mk...
//   principalDID:   did:key:z6Mk...
//   remainingLimit: 9.999
//   scopes:         [weather:read]

Works with your stack

Drop Grantex into any AI framework or language runtime.

Runnable code you can copy

End-to-end examples for every SDK and framework integration. Clone the repo, start the local stack, and run.

Built to enterprise standards

Security audited, standards-track, open source.

Join the Grantex community

Connect with developers building the trust layer for AI agents.