Alien Agent ID — Auth

Per-request DPoP signing for HTTP calls to Alien-aware services. Each request carries:

• Authorization: DPoP <access-token> — the SSO-issued, agent-bound access token.
• DPoP: <jws> — a fresh proof that binds this request to its method + URL + access token (RFC 9449 §4.2).

Servers verify the proof's cnf.jkt against the agent's key, so a captured token cannot be replayed by a different client. The CLI generates the per-request proof; raw curl/fetch will get 401.

Requires that agent-id-core bootstrap has produced a keypair and bound an owner under ${AGENT_ID_STATE_DIR:-$HOME/.agent-id}.

Resolve the CLI

bin/cli.mjs lives in this plugin's directory. In the examples below, CLI is ${CLAUDE_PLUGIN_ROOT}/bin/cli.mjs — the ${CLAUDE_PLUGIN_ROOT} path is filled in for you when the skill loads.

When the user gives you a URL on an Alien-aware service

Run discovery before any other access (including WebFetch). Alien-aware services expose a machine-readable manifest at /.well-known/alien-agent-id.json: