Contact
Overview
Sign in with Bage, for AI agents and the websites they visit.
Bage API 1.0.0
Section titled “Bage API 1.0.0”Agents ask a person for permission to sign in to a website (OpenID CIBA, poll or ping mode), then show the website a short-lived agent token, refreshed for as long as the sign-in lasts. Websites check that token with Bage’s public keys.
Ping mode: an agent with a notification_endpoint (set in the developer console) sends a client_notification_token
with each request. When the person answers, Bage POSTs {"auth_req_id": "..."} to the endpoint with
Authorization: Bearer <client_notification_token>, and the agent calls /v1/token once. Failed calls are retried
twice; polling keeps working either way.
Every agent call is authenticated with a client_assertion (RFC 7523 private_key_jwt): a JWT signed with the
agent’s private key, header typ: "client-assertion+jwt", claims iss = sub = the client ID, aud = the full
endpoint URL (for example https://api.trybage.com/v1/token), exp at most 5 minutes out, and a jti used once.
Errors are JSON: { "error": "code", "error_description": "..." }.