Browser platforms

A browser platform already signs its traffic with its own Web Bot Auth key, which tells a site “a request from our browsers”. Bage adds whose agent it is and that the person approved it. With Bage, your browsers sign with your own key as they do today, and carry a Bage token bound to that key.

1. Register as a platform

Start free in the console, or use the API, and register a client with kind: "platform". It’s self-serve: you get a client ID at once and keep the private key, like an agent.

2. Attest a browser’s key for an agent

When an agent starts one of your browsers, tell it which key that browser signs with, signed by your platform key:

platform.ts

import { BagePlatform } from "@trybage/sdk/agent";

const platform = new BagePlatform({ issuer: "https://api.trybage.com", clientId: "agt_platform…", privateJwk });
const attestation = platform.attestKey({ agentId: "agt_scout…", publicJwk: browserSessionPublicKey, session: browser.id });
// hand `attestation` to the agent with the browser

The agent binds its sign-in to that key:

agent.ts

const session = await agent.signIn({
  site: "https://shop.example",
  loginHint: "alex@example.com",
  scopes: ["browse"],
  bindTo: { platformAttestation: attestation },
});
// give session.token to the platform; from here, the platform's browser signs every request to shop.example

The person sees “Scout, in a Kernel browser” on the approval screen, and the token names you in a nested act claim:

"act": { "sub": "agt_scout…", "name": "Scout", "operator": "Scout Labs",
         "act": { "sub": "agt_platform…", "name": "Kernel", "operator": "Kernel" } },
"cnf": { "jkt": "<your browser key's thumbprint>" }

Sites verify your usual Web Bot Auth signature (covering at least @authority and signature-agent) against the token’s cnf key, and see platform on the verified agent.

3. Register the agents you host (optional)

A platform can register agents for its customers. They’re normal Bage agents that always sign in through you, and stop when you disable them or yourself.

const scout = await platform.createAgent({ name: "Scout", operator: "Scout Labs", publicJwk: customerPublicKey });
await platform.listAgents();
await platform.disableAgent(scout.client_id);

What sites can do

A verified website can block or allow a whole platform in the console, like any agent. Blocking it cuts off every agent signing in through it there, at once. Disabling your platform revokes every token issued through it.